Find Malware Trends

This demo illustrates the power of KeyLines when visualising complex cyber-security data. The chart, time bar and side controls allow exploration of the data and discovery of both broad trends and precise details of the infection of particular machines and their immediate environments.

The data, taken from https://www.abuse.ch/, contains information about the infection of machines by 8 different identified malware. The dataset covers a 5 year period, which can be filtered to only show the machines active at the end of the period - the end of December 2015.

When one or more malware are selected the chart shows all infection for that malware, and a colour-coded trend line shows the relative infections rate. Tool tips for the histogram bars and trend lines show total infected machines.

The servers acting as 'Command and Control' ('C&C') machines for a set of botnets are coloured pale blue.

These machines have an association with an 'ISP' and also one or more hosts that are the contact point(s) for their botnets. ISPs are shown with a flag to indicate their geographic location.

The chart provides insight on the detail of C&C machine communications with their botnets, and the geography of infection.

There are two obvious dense clusters in the chart. One represents a set of C&C machines associated with a German ISP (ASN AS24940), the other a French one (AS16276) - which is a possible indication of a poorly managed domain.

Another significant node is the C&C machine 195.16.127.102, scaled larger due to the number of hosts associated with it. This Russian machine has 8 different compromised hosts, each using *.hotmail.ru addresses to communicate with their fleet of botnets.

Key functions used:

Code

import KeyLines from "keylines";
import data from "./data.js";

let chart;
let timebar;
const IPsLinkedHosts = {};
const maxMalwareSelection = 3;
const tooltipElements = {
  tooltip: document.getElementById("tooltip"),
  servers: document.getElementById("servers"),
};

const onlineOnlyButton = document.getElementById("onlineOnly");

async function doLayout() {
  await chart.layout("organic", {
    time: 400,
    easing: "linear",
    mode: "adaptive",
  });
}

function getSelectionCriteria(malwares) {
  const showOnlyOnline = onlineOnlyButton.value === "Show All";
  return (item) => {
    const status = showOnlyOnline ? item.d.status === "online" : true;

    if (item.d.type === "asn") return true;

    if (malwares) return item.d.malware in malwares && status;
    return status;
  };
}

function highlightMalware(malwares) {
  timebar.selection(Object.values(malwares));
  chart.foreground(
    getSelectionCriteria(Object.keys(malwares).length !== 0 ? malwares : null),
    {
      animate: false,
      type: "link",
    },
  );
}

function showTrends() {
  // Find the checked checkboxes
  const checkedMalwares = Array.from(
    document.querySelectorAll("input[name=malware]:checked"),
  );

  // If there are more than 3, uncheck the 4th one until there are just 3
  while (checkedMalwares.length > maxMalwareSelection) {
    checkedMalwares.pop().checked = false;
  }

  const reachedMaxSelections = checkedMalwares.length === maxMalwareSelection;
  document
    .querySelectorAll("input[name=malware]:not(:checked)")
    .forEach((radioButton) => {
      radioButton.disabled = reachedMaxSelections;
      radioButton.parentElement.style.color = reachedMaxSelections
        ? "DarkGray"
        : "black";
    });

  const malwareNames = {};

  checkedMalwares.forEach((element, index) => {
    const elementColour = element.parentElement
      .getElementsByTagName("dt")
      .item(0).style.background;
    malwareNames[element.value] = { id: [], index, c: elementColour };
  });

  chart.each({ type: "link" }, (link) => {
    if (link.d.malware in malwareNames) {
      malwareNames[link.d.malware].id.push(link.id1);
    }
  });

  // Update timebar selection and chart foregrounding
  timebar.selection([]);
  highlightMalware(malwareNames);
}

function showInfo() {
  const info = document.getElementById("info");

  const selection = chart.selection();

  let title = "";
  let status = "";
  let imageDisplayStyle = "none";

  if (selection.length === 1) {
    const item = chart.getItem(selection[0]);

    if (item.type === "node" && item.d.type === "host") {
      title = item.d.host;
      status = `Current status: <span class="${item.d.status}">${item.d.status}</span>`;
      imageDisplayStyle = "block";
    }
  }
  info.getElementsByTagName("h5").item(0).innerText = title;
  info.getElementsByTagName("p").item(0).innerHTML = status;
  info.getElementsByTagName("img").item(0).style.display = imageDisplayStyle;
}

function mergeObjects(object2, object1) {
  Object.keys(object1).forEach((host) => {
    object2[host] = object1[host];
  });
  return object2;
}

// Cache results for filtering by time. Only host nodes have timestamps so we need
// a reference for other node types to see what they're linked to
function calculateIPsNeighbours() {
  // Build a quick lookup for each item using IP & ISP
  chart.each({ type: "link" }, (link) => {
    if (link.d.type === "Host2IP") {
      IPsLinkedHosts[link.id2] = IPsLinkedHosts[link.id2] || {};
      IPsLinkedHosts[link.id2][link.id1] = 1;
    }
  });

  // Now do another pass to filter for the ISP
  chart.each({ type: "link" }, (link) => {
    if (link.d.type === "IP2ISP") {
      IPsLinkedHosts[link.id2] = IPsLinkedHosts[link.id2] || {};
      // now add all the hosts associated with the IP
      IPsLinkedHosts[link.id2] = mergeObjects(
        IPsLinkedHosts[link.id2],
        IPsLinkedHosts[link.id1],
      );
    }
  });
}

function checkNeighbours(obj) {
  return obj && Object.keys(obj).some((id) => timebar.inRange(id));
}

function filterByTimeRange(item) {
  if (item.type === "node") {
    return timebar.inRange(item.id) || checkNeighbours(IPsLinkedHosts[item.id]);
  }
  return (
    timebar.inRange(item.id1) ||
    timebar.inRange(item.id2) ||
    checkNeighbours(IPsLinkedHosts[item.id1]) ||
    checkNeighbours(IPsLinkedHosts[item.id2])
  );
}

function hideTooltip() {
  tooltipElements.tooltip.classList.add("fadeout");
}

async function filterItemsInTimeRange() {
  hideTooltip();
  // Filter the chart to show only items in the new range
  await chart.filter(filterByTimeRange, {
    animate: false,
    type: "all",
    hideSingletons: true,
  });
  // And then adjust the chart's layout
  doLayout();
}

function showTooltip({ type, value: numberOfServer, tooltipX, tooltipY }) {
  const hoverOverData = type === "bar" || type === "selection";
  const { servers, tooltip } = tooltipElements;
  if (hoverOverData) {
    // If the target is data, update the tooltip content
    servers.innerText = numberOfServer;

    // The top needs to be adjusted to accommodate the height of the tooltip
    const tooltipTop = tooltipY - tooltip.offsetHeight - 15;
    // Shift left by half width to centre it
    const tooltipLeft = tooltipX - tooltip.offsetWidth / 2;
    // Set the position of the tooltip
    tooltip.style.left = `${tooltipLeft}px`;
    tooltip.style.top = `${tooltipTop}px`;
    // Show the tooltip
    tooltip.classList.remove("fadeout");
  } else {
    hideTooltip();
  }
}

function initialiseInteractions() {
  timebar.on("change", filterItemsInTimeRange);
  timebar.on("hover", showTooltip);
  chart.on("selection-change", showInfo);

  const malwareCheckboxes = document.getElementsByClassName("malware");

  Array.from(malwareCheckboxes).forEach((checkbox) => {
    checkbox.addEventListener("change", showTrends);
  });

  document.getElementById("clearFilter").addEventListener("click", () => {
    Array.from(malwareCheckboxes).forEach((checkbox) => {
      checkbox.checked = false;
    });
    showTrends();
    doLayout();
  });

  onlineOnlyButton.addEventListener("click", () => {
    onlineOnlyButton.value =
      onlineOnlyButton.value === "Show All" ? "Only Show Online" : "Show All";
    showTrends();
  });
}

async function loadDataAndLayout() {
  chart.load(data);
  await chart.zoom("fit");
  await timebar.load(data);
  timebar.zoom("fit", { animate: false });
  // Run the layout
  doLayout();
}

async function loadKeyLines() {
  const chartOptions = {
    logo: "/public/images/Logo.png",
    minZoom: 0.01,
    handMode: true,
    linkEnds: { avoidLabels: false },
    overview: {
      icon: false,
      shown: false,
    },
  };

  const timebarOptions = {
    showPlay: false,
    showExtend: true,
    maxRange: {
      value: 5,
      units: "year",
    },
  };

  const components = await KeyLines.create([
    { id: "kl", container: "klchart", options: chartOptions },
    {
      id: "tl",
      container: "kltimebar",
      type: "timebar",
      options: timebarOptions,
    },
  ]);

  chart = components[0];
  timebar = components[1];

  await loadDataAndLayout();
  calculateIPsNeighbours();
  initialiseInteractions();
}

window.addEventListener("DOMContentLoaded", loadKeyLines);

Data

const data = {
  type: "LinkChart",
  items: [
    {
      id: "host-want-to-buy.co.uk",
      type: "node",
      t: "Host\nwant-to-buy.co.uk",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "want-to-buy.co.uk" },
      e: 1,
      dt: [1450224000000],
    },
    {
      id: "185.24.98.175",
      type: "node",
      t: "185.24.98.175",
      d: { type: "ip", sbl: "SBL279785", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS198047",
      type: "node",
      t: "UKWEB-EQX UK Webhosting Ltd,GB\n(AS198047)",
      u: "/public/images/malware/wwwgeonamesorgflagsxgb.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-46.105.161.233",
      type: "node",
      t: "Host\n46.105.161.233",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "46.105.161.233" },
      e: 1,
      dt: [1450137600000],
    },
    {
      id: "46.105.161.233",
      type: "node",
      t: "46.105.161.233",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS16276",
      type: "node",
      t: "OVH OVH SAS,FR\n(AS16276)",
      u: "/public/images/malware/wwwgeonamesorgflagsxfr.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-www.presidentialemail.in",
      type: "node",
      t: "Host\nwww.presidentialemail.in",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "www.presidentialemail.in" },
      e: 1,
      dt: [1449878400000],
    },
    {
      id: "162.144.218.223",
      type: "node",
      t: "162.144.218.223",
      d: { type: "ip", sbl: "SBL279557", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS46606",
      type: "node",
      t: "UNIFIEDLAYER-AS-1 - Unified Layer, uS\n(AS46606)",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-soundstrategyaccounts.com.au",
      type: "node",
      t: "Host\nsoundstrategyaccounts.com.au",
      u: "/public/images/icons/email.png",
      d: {
        type: "host",
        status: "online",
        host: "soundstrategyaccounts.com.au",
      },
      e: 1,
      dt: [1449792000000],
    },
    {
      id: "27.121.64.42",
      type: "node",
      t: "27.121.64.42",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS24446",
      type: "node",
      t: "NETREGISTRY-AS-AP NetRegistry Pty Ltd.,AU\n(AS24446)",
      u: "/public/images/malware/wwwgeonamesorgflagsxau.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-studio020.com",
      type: "node",
      t: "Host\nstudio020.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "studio020.com" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "83.98.177.7",
      type: "node",
      t: "83.98.177.7",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS25525",
      type: "node",
      t: "ASN AS25525",
      u: "/public/images/malware/wwwgeonamesorgflagsxnl.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-ebenezerfm.com",
      type: "node",
      t: "Host\nebenezerfm.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "ebenezerfm.com" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "69.4.233.96",
      type: "node",
      t: "69.4.233.96",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS36351",
      type: "node",
      t: "SOFTLAYER - SoftLayer Technologies Inc., uS\n(AS36351)",
      u: "/public/images/malware/wwwgeonamesorgflagsxsg.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-sydneyboatlicence.com",
      type: "node",
      t: "Host\nsydneyboatlicence.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "sydneyboatlicence.com" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "27.121.64.40",
      type: "node",
      t: "27.121.64.40",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-mat-update.be",
      type: "node",
      t: "Host\nmat-update.be",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "mat-update.be" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "198.105.221.5",
      type: "node",
      t: "198.105.221.5",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 3,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-phoenixtsi.com",
      type: "node",
      t: "Host\nphoenixtsi.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "phoenixtsi.com" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "72.167.1.1",
      type: "node",
      t: "72.167.1.1",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS26496",
      type: "node",
      t: "ASN AS26496",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-178.32.79.71",
      type: "node",
      t: "Host\n178.32.79.71",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "178.32.79.71" },
      e: 1,
      dt: [1449705600000],
    },
    {
      id: "178.32.79.71",
      type: "node",
      t: "178.32.79.71",
      d: { type: "ip", sbl: "SBL279073", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-emreerdem.com.tr",
      type: "node",
      t: "Host\nemreerdem.com.tr",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "emreerdem.com.tr" },
      e: 1,
      dt: [1449619200000],
    },
    {
      id: "85.95.237.78",
      type: "node",
      t: "85.95.237.78",
      d: { type: "ip", sbl: "SBL278986", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS42926",
      type: "node",
      t: "RADORE Radore Veri Merkezi Hizmetleri A.S., tR\n(AS42926)",
      u: "/public/images/malware/wwwgeonamesorgflagsxtr.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-beautifulmindsinc.com",
      type: "node",
      t: "Host\nbeautifulmindsinc.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "beautifulmindsinc.com" },
      e: 1,
      dt: [1449532800000],
    },
    {
      id: "184.168.56.1",
      type: "node",
      t: "184.168.56.1",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-simdie.com",
      type: "node",
      t: "Host\nsimdie.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "simdie.com" },
      e: 1,
      dt: [1449360000000],
    },
    {
      id: "AS29854",
      type: "node",
      t: "ASN AS29854",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-secretgardener.melbourne",
      type: "node",
      t: "Host\nsecretgardener.melbourne",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "secretgardener.melbourne" },
      e: 1,
      dt: [1449360000000],
    },
    {
      id: "27.121.64.85",
      type: "node",
      t: "27.121.64.85",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-maminoleinc.tk",
      type: "node",
      t: "Host\nmaminoleinc.tk",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "maminoleinc.tk" },
      e: 1,
      dt: [1449187200000],
    },
    {
      id: "195.20.41.233",
      type: "node",
      t: "195.20.41.233",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS31624",
      type: "node",
      t: "ASN AS31624",
      u: "/public/images/malware/wwwgeonamesorgflagsxnl.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-studentscompanion.in",
      type: "node",
      t: "Host\nstudentscompanion.in",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "studentscompanion.in" },
      e: 1,
      dt: [1449187200000],
    },
    {
      id: "184.95.41.121",
      type: "node",
      t: "184.95.41.121",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 4,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS20454",
      type: "node",
      t: "ASN AS20454",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-beemasewakendra.com",
      type: "node",
      t: "Host\nbeemasewakendra.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "beemasewakendra.com" },
      e: 1,
      dt: [1449187200000],
    },
    {
      id: "host-saner.com.au",
      type: "node",
      t: "Host\nsaner.com.au",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "saner.com.au" },
      e: 1,
      dt: [1449100800000],
    },
    {
      id: "27.121.64.74",
      type: "node",
      t: "27.121.64.74",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-sundarbantourpackages.com",
      type: "node",
      t: "Host\nsundarbantourpackages.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "sundarbantourpackages.com" },
      e: 1,
      dt: [1449100800000],
    },
    {
      id: "162.144.156.80",
      type: "node",
      t: "162.144.156.80",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-176.31.66.75",
      type: "node",
      t: "Host\n176.31.66.75",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "176.31.66.75" },
      e: 1,
      dt: [1449100800000],
    },
    {
      id: "176.31.66.75",
      type: "node",
      t: "176.31.66.75",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-2becomputers.com",
      type: "node",
      t: "Host\n2becomputers.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "2becomputers.com" },
      e: 1,
      dt: [1448928000000],
    },
    {
      id: "198.50.98.253",
      type: "node",
      t: "198.50.98.253",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS32613",
      type: "node",
      t: "IWEB-AS - iWeb Technologies Inc.,CA\n(AS32613)",
      u: "/public/images/malware/wwwgeonamesorgflagsxca.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-198.27.87.34",
      type: "node",
      t: "Host\n198.27.87.34",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "198.27.87.34" },
      e: 1,
      dt: [1448928000000],
    },
    {
      id: "198.27.87.34",
      type: "node",
      t: "198.27.87.34",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-www.lihuazhai.com",
      type: "node",
      t: "Host\nwww.lihuazhai.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "www.lihuazhai.com" },
      e: 1,
      dt: [1448841600000],
    },
    {
      id: "42.96.169.237",
      type: "node",
      t: "42.96.169.237",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS37963",
      type: "node",
      t: "CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd.,CN\n(AS37963)",
      u: "/public/images/malware/wwwgeonamesorgflagsxcn.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-helenasoap.si",
      type: "node",
      t: "Host\nhelenasoap.si",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "helenasoap.si" },
      e: 1,
      dt: [1448841600000],
    },
    {
      id: "146.247.25.151",
      type: "node",
      t: "146.247.25.151",
      d: { type: "ip", sbl: "SBL262120", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS57127",
      type: "node",
      t: "ASN AS57127",
      u: "/public/images/malware/wwwgeonamesorgflagsxsi.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-91.236.213.74",
      type: "node",
      t: "Host\n91.236.213.74",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "91.236.213.74" },
      e: 1,
      dt: [1448755200000],
    },
    {
      id: "91.236.213.74",
      type: "node",
      t: "91.236.213.74",
      d: { type: "ip", sbl: "SBL277887", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS198582",
      type: "node",
      t: "DONAIR-AS Municipal Enterprise 'International Airport Donetsk', uA\n(AS198582)",
      u: "/public/images/malware/wwwgeonamesorgflagsxua.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-satyamsng.com",
      type: "node",
      t: "Host\nsatyamsng.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "satyamsng.com" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "host-192.99.99.251",
      type: "node",
      t: "Host\n192.99.99.251",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "192.99.99.251" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "192.99.99.251",
      type: "node",
      t: "192.99.99.251",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-omnienergy.com.au",
      type: "node",
      t: "Host\nomnienergy.com.au",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "omnienergy.com.au" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "27.121.64.198",
      type: "node",
      t: "27.121.64.198",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-nasscomminc.tk",
      type: "node",
      t: "Host\nnasscomminc.tk",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "nasscomminc.tk" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "195.20.44.100",
      type: "node",
      t: "195.20.44.100",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-66.34.9.70",
      type: "node",
      t: "Host\n66.34.9.70",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "66.34.9.70" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "66.34.9.70",
      type: "node",
      t: "66.34.9.70",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS54489",
      type: "node",
      t: "CORESPACE-DAL - CoreSpace, Inc., uS\n(AS54489)",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-janvermeulenmontage.nl",
      type: "node",
      t: "Host\njanvermeulenmontage.nl",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "janvermeulenmontage.nl" },
      e: 1,
      dt: [1448668800000],
    },
    {
      id: "109.72.85.122",
      type: "node",
      t: "109.72.85.122",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS48635",
      type: "node",
      t: "PCEXTREME PCextreme B.V.,NL\n(AS48635)",
      u: "/public/images/malware/wwwgeonamesorgflagsxnl.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-188.165.84.115",
      type: "node",
      t: "Host\n188.165.84.115",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "188.165.84.115" },
      e: 1,
      dt: [1445558400000],
    },
    {
      id: "188.165.84.115",
      type: "node",
      t: "188.165.84.115",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-alliedairduct.com",
      type: "node",
      t: "Host\nalliedairduct.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "alliedairduct.com" },
      e: 1,
      dt: [1445472000000],
    },
    {
      id: "205.204.75.242",
      type: "node",
      t: "205.204.75.242",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS10929",
      type: "node",
      t: "NETELLIGENT - Netelligent Hosting Services Inc.,CA\n(AS10929)",
      u: "/public/images/malware/wwwgeonamesorgflagsxca.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-neuberchile.com",
      type: "node",
      t: "Host\nneuberchile.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "neuberchile.com" },
      e: 1,
      dt: [1445472000000],
    },
    {
      id: "190.196.128.198",
      type: "node",
      t: "190.196.128.198",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS14259",
      type: "node",
      t: "ASN AS14259",
      u: "/public/images/malware/wwwgeonamesorgflagsxcl.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-www.kafinvest.com",
      type: "node",
      t: "Host\nwww.kafinvest.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "www.kafinvest.com" },
      e: 1,
      dt: [1445472000000],
    },
    {
      id: "213.229.91.9",
      type: "node",
      t: "213.229.91.9",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS29550",
      type: "node",
      t: "ASN AS29550",
      u: "/public/images/malware/wwwgeonamesorgflagsxgb.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-markhousecm.com",
      type: "node",
      t: "Host\nmarkhousecm.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "markhousecm.com" },
      e: 1,
      dt: [1445472000000],
    },
    {
      id: "122.155.10.197",
      type: "node",
      t: "122.155.10.197",
      d: { type: "ip", sbl: "SBL274049", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS9931",
      type: "node",
      t: "CAT-AP The Communication Authoity of Thailand, CAT, tH\n(AS9931)",
      u: "/public/images/malware/wwwgeonamesorgflagsxth.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-195.62.29.81",
      type: "node",
      t: "Host\n195.62.29.81",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "195.62.29.81" },
      e: 1,
      dt: [1445212800000],
    },
    {
      id: "195.62.29.81",
      type: "node",
      t: "195.62.29.81",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-104.166.67.26",
      type: "node",
      t: "Host\n104.166.67.26",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "104.166.67.26" },
      e: 1,
      dt: [1445126400000],
    },
    {
      id: "104.166.67.26",
      type: "node",
      t: "104.166.67.26",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS46261",
      type: "node",
      t: "QUICKPACKET - QuickPacket, LLC, uS\n(AS46261)",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-chaitanyagroupindia.com",
      type: "node",
      t: "Host\nchaitanyagroupindia.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "chaitanyagroupindia.com" },
      e: 1,
      dt: [1445126400000],
    },
    {
      id: "103.224.243.146",
      type: "node",
      t: "103.224.243.146",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS133295",
      type: "node",
      t: "NEOSOFT-AS Neosoft Technologies International,IN\n(AS133295)",
      u: "/public/images/malware/wwwgeonamesorgflagsxin.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-cheshamfrench.co.uk",
      type: "node",
      t: "Host\ncheshamfrench.co.uk",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "cheshamfrench.co.uk" },
      e: 1,
      dt: [1444867200000],
    },
    {
      id: "69.28.199.60",
      type: "node",
      t: "69.28.199.60",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 3,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS13768",
      type: "node",
      t: "ASN AS13768",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-boombuckspartys.com.au",
      type: "node",
      t: "Host\nboombuckspartys.com.au",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "boombuckspartys.com.au" },
      e: 1,
      dt: [1444867200000],
    },
    {
      id: "202.191.62.219",
      type: "node",
      t: "202.191.62.219",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "host-asagroupltd.com",
      type: "node",
      t: "Host\nasagroupltd.com",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "online", host: "asagroupltd.com" },
      e: 1,
      dt: [1444867200000],
    },
    {
      id: "209.147.127.135",
      type: "node",
      t: "209.147.127.135",
      d: { type: "ip", sbl: "Not listed", status: "online" },
      e: 2,
      b: "#D9D9D9",
      c: "#D1E3FF",
    },
    {
      id: "AS30170",
      type: "node",
      t: "OPTICFUSION - Isomedia, Inc., uS\n(AS30170)",
      u: "/public/images/malware/wwwgeonamesorgflagsxus.jpg",
      d: { type: "asn" },
      e: 1,
      ci: true,
      b: "grey",
    },
    {
      id: "host-167.114.89.205",
      type: "node",
      t: "Host\n167.114.89.205",
      u: "/public/images/icons/email.png",
      d: { type: "host", status: "unknown", host: "167.114.89.205" },
      e: 1,
      dt: [1444780800000],
    },
    {
      id: "167.114.89.205",
      type: "node",
      t: "167.114.89.205",
      d: { type: "ip", sbl: "Not listed", status: "unknown" },

// ...truncated 27763 lines

HTML

<!doctype html>
<html lang="en" style="background-color: #2d383f">
  <head>
    <meta charset="utf-8" />
    <title>Find Malware Trends</title>
    <link rel="stylesheet" type="text/css" href="@ci/theme/kl/css/keylines.css" />
    <link rel="stylesheet" type="text/css" href="@ci/theme/kl/css/minimalsdk.css" />
    <link rel="stylesheet" type="text/css" href="@ci/theme/kl/css/sdk-layout.css" />
    <link rel="stylesheet" type="text/css" href="@ci/theme/kl/css/demo.css" />
    <link rel="stylesheet" href="./style.css" />
  </head>
  <body>
    <div id="klchart" class="klchart klchart-timebar"></div>
    <div id="kltimebar" class="kltimebar"></div>
    <script type="module" src="./code.js"></script>
  </body>
</html>

CSS

dl {
  margin-bottom: 50px;
}

dl dt {
  color: #fff;
  float: left;
  font-weight: bold;
  margin-right: 10px;
  padding: 3px;
  width: 18px;
  border-radius: 18px;
  line-height: 12px;
}

dl dd {
  margin: 2px 0;
  padding: 5px 0;
  line-height: 12px;
}

span.unknown,
span.online,
span.offline {
  font-weight: bold;
}

.unknown {
  color: grey;
}

.online {
  color: green;
}

.offline {
  color: red;
}

#loadingBarText {
  text-align: center;
  margin-top: -40px;
}

#info {
  height: 70px;
  max-width: 99%;
  border: lightgray solid 1px;
}

/* Tooltip styling */

#tooltip {
  opacity: 0.8;
  transition: opacity 0.3s ease;
  display: block;
  line-height: 18px;
  text-align: center;
  z-index: 1001;
}

#tooltip .inner {
  background-color: grey;
  color: white;
  padding: 4px;
}

#tooltip .arrow {
  position: absolute;
  border: solid 8px grey;
  border-top-color: transparent;
  border-left-color: transparent;
  transform: translate(-5px, 60px) rotateZ(45deg);
  position: absolute;
  top: -10px;
  left: 48px;
  width: 16px;
  height: 16px;
}

#tooltip.fadeout {
  opacity: 0;
}

#servers {
  font-size: 22px;
}

#info {
  display: inline-block;
  width: 100%;
}
#info .imagediv {
  display: inline-block;
  width: 64px;
}
#info .textdiv {
  position: relative;
  top: -10px;
  display: inline-block;
  width: calc(100% - 68px);
}

Search

Terms of use