Understanding Country Risk Trends

The trend percentage compares a country's 24-hour report volume against its daily average over the past 7 days. A rising trend (shown in red) means attacks from that country are increasing beyond the weekly baseline, which may indicate an active campaign, newly compromised botnets, or a shift in attacker infrastructure. A declining trend (shown in green) suggests a reduction in malicious activity, possibly due to takedowns, patching, or law enforcement actions.

Countries with high absolute numbers but stable trends represent persistent threat sources with established malicious infrastructure. Countries with sudden spikes deserve immediate attention as they may signal emerging threats.