All Internet evil, mapped: evil score visualization 2

[theymos]

I did this back in 2015, but I wanted to update it. I used exactly the same mapping code as last time.

When someone is banned, their IP and some of their neighboring IPs receive evil points. Here I've created a map of the IPv4 Internet according to evil points. Currently, IPv6 is mapped into the 240.0.0/4 range, which is the large square taking up the top-right sixteenth of the chart. (I'm not sure yet whether IPv6 is actually disproportionately evil, or if I'm just cramming too many people into that address-space. Probably the latter is at least something of a factor, since 9% of traffic is IPv6 but 6% of this address-space is IPv6.)

Here's the image (zoom in):
https://bitcointalk.org/banmap201805.png

For comparison, here's the one from 2015:
https://bitcointalk.org/banmap201510.png

Each pixel is a /24 address block (ie. each pixel represents 256 IP addresses). The colors are:
█ Zero or nearly zero evil
█ A small amount of evil
█ More
█ More
█ At this point you actually have to pay if you register an account in this block
█ More
█ More
█ More
█ Pretty high
█ A ton of evil, more than anyone is likely to pay

This is per block, so a single IP address could have an evil score requiring payment while its block still shows up as black here. A colored pixel indicates the evil score of a typical IP in that block.

Addresses are laid out in the standard way. So you can for example cross-reference with these maps: https://ant.isi.edu/address/

A /24 should almost never uniquely identify someone, but to be safe I randomly added, removed, and modified some of this data for plausible deniability.

[xolxol]

Maybe you can do this color coding to the current trust system?

[mdayonliner]

I am trying to figure it out, how it has been done 

Looking at the Current and the older one, it's clearly visible that the amount of popularity of BitcoinTalk increased dramatically.
More ban = more demand  LOL

[Quickseller]

It looks like there are a fairly decent number of spammer “groups” that utilize blocks of IP addresses.

It might be useful to remove what is likely isolated incidents of “evil”, look for patterns and then apply those types of patterns to IP address blocks that have growing amounts of “evil”.

Interestingly, it looks like the number of spammers is growing at a fairly decent clip.

[LoyceV]

It might be useful to remove what is likely isolated incidents of “evil”, look for patterns and then apply those types of patterns to IP address blocks that have growing amounts of “evil”.

I can recognize very clear rectangles, especially in the "future use" (top right) area. If evil accounts cover that much of the address area, I'd say color in the whole rectangle.

█ Pretty high
█ A ton of evil, more than anyone is likely to pay

Does this mean someone created many accounts from the same IP, then got them all banned?
This was suggested last week to stop this:

Most of the people who sign up here likely won't have to pay anything at all so anyone can create thousands of accounts from their home IP or any other one that hasn't yet been banned.

Isn't this a flaw in the units of evil system?

I wouldn't be against limiting accounts to one sign-up per IP as people would quickly run out of fresh connections.

As the proud owner of more than one account, I'd have to disagree. Using a few accounts keeps my main account more secure.
But I wouldn't mind if any IP starts collecting units of evil after signing up. Say the first 2 accounts are free, and after that each new signup adds one more unit of evil.

I guess. I think a better solution would be an IP gets evil points every time an account is registered from it. First one is free but then the the points get exponentially greater for every account that is registered. I think people should be allowed to have multiple accounts but there's no reason why people should have hundreds and I think this would curb people who sign up here with dozens of accounts each from each family member on the home IP and making people work to find a new connection would slow them down a lot.

[Piggy]

There must be a better way to display this information in a more meaningful way. Could you share the raw data, maybe masking the ip addresses if the information itself is considered 'sensible'?

[Quickseller]

There must be a better way to display this information in a more meaningful way. Could you share the raw data, maybe masking the ip addresses if the information itself is considered 'sensible'?

I have my doubts that you will do anything with the raw data, however instructions on how to convert the images to raw data were posted in the OP. See this link, you would reverse engineer the process.