Reading attack trends: sources, targets and industry rankings
Interpret Radar dimensions and time windows without treating source geography as attacker identity.
Contents of this article
Read the dimension before the ranking
Radar distinguishes request sources and attack-distribution source and target locations. Check the chart, geography, ASN and metric. Proxies and compromised devices can affect apparent origins; map colors do not establish an attacker’s identity.
Align windows and units
Use matching durations, intervals and time zones, and distinguish counts, shares and normalized trends. Rank changes do not necessarily represent proportional changes in absolute volume, particularly with small samples.
Use trends for preparation
Translate sector observations into workload checks: publishing peaks for media, login and match entry points for games, and search and callbacks for stores. Sector rankings do not predict an individual victim or directly size a purchase.
Pair external context with local evidence
Compare external observations with local baselines, incident times and service impact. Attribute the source, period and metric, separating observations from analysis. Leave unavailable values unknown rather than inventing real-time attack figures.