The table in Figure 4 shows the top 50 ASNs attacking Australia from Dec 1, 2018 to March 1, 2019 in order of highest to lowest number of attacks. Interestingly, these top 50 networks were split fifty-fifty between ISPs and hosting companies whereas the company types attacking other regions lean heavier towards ISPs. For comparison, ISPs accounted for 90% of attacks against US systems and 72% of European systems in the same time period. Attacks coming from a system in a hosting network are more likely to be launched by a threat actor either renting or maliciously controlling a server in the hosting environment. Systems residing in an ISP network are more likely to be a compromised residential or small office IoT devices, unless the attacker does nothing to disguise their activities (like using a proxy or VPN).
 

Figure 4: Top 50 ASNs attacking Australian systems

Most of the top 50 attacking ASNs were seen attacking European and Canadian systems in the same time period with very little overlap with the US. The exception was Chinese networks that were seen consistently attacking systems across the entire world. The following 19 networks exclusively targeted Australian systems, most of which were hosting companies:
 

Figure 5: Networks targeting Australian systems not seen targeting other regions

Top Attacking IP Addresses

Unlike the consistency seen between networks attacking Australian, European, and Canadian systems, there was no consistency in the IP addresses used in those networks to attack. Forty-eight (96%) of the top 50 attacking IP addresses were unique to attacks against Australia. The number one attacking IP address (58.242.83.26), resolving to ISP China Unicom, also attacked systems in the US in the same time period. The other IP address (185.107.80.31), resolving to NForce Entertainment, a hosting provider in the Netherlands, also attacked systems in Canada during the same time period.

This can indicate that attackers are using specific (hosting) networks from which they know they can successfully launch attacks (and spinning up new systems or getting dynamic IP addresses from which to launch attacks), or they are exploiting vulnerabilities in systems resolving to ISPs, like residential or commercial IoT devices, and keep using new systems. Both scenarios result in new IP addresses from the same networks. And both scenarios are likely in the attacks against Australia, given the attacking ASNs are a fifty-fifty split between hosting providers and ISPs. The chart in Figure 6 below shows the top 50 IP addresses attacking destinations in Australia from Dec 1, 2018 through March 1, 2019 by count.