undefined | Better HN

0 pointsstjohnswarts4y ago0 comments

I get a bunch of Indian IPs as well but probably 80% (non domestic) are russian or chinese for my ssh honeypot on port 22. USA scans are roughly 28%, I don't know if people outside the USA get hammered like that though. I keep it up just for fun. Minimal debian install with only SSH port 22 enabled and auto security updates (and a daily script to update and reboot) and you'd think that I had a fort knox full of gold in there lol. It's pretty insane how bots there are out there banging on the gates. It serves as a good reminder how goddamn hostile the internet is.

0 comments

3 comments · 2 top-level

jandrese4y ago· 1 in thread

I don't think the geo matters much. The bots seem to be scanning the entire IPv4 address space. This is the one big benefit I try to pitch to people who are considering IPv6. In all my years of log monitoring I have only ever seen a single bot attack my network over IPv6, and that was the one I manually programmed to make sure the detection system was working. The search space is just too large for the full internet sweeps that bots make.

0x0734y ago

Every really relevant server has a ipv4 address. Why should bots try ipv6 if it works with ip V4.

And I don't know how much bots scan the whole ipv4 address space, but doesn't they use up lists that are parsed from dns. ( SSL transparency report is a good start e.g.)?

throwanem4y ago

I've had VPSes hosted outside the US and not seen much difference in scan traffic, although it's been years and maybe things are different now.

j / k navigate · click thread line to collapse