4 ms·
definitely not interesting, but they're on port 8022 so maybe that's a common one for attack scanners. i mean with masscan its so fast and easy to find ssh port
by dp30 9y ago
definitely not interesting, but they're on port 8022 so maybe that's a common one for attack scanners. i mean with masscan its so fast and easy to find ssh ports, i cant imagine any non-standard port is more obscure than the next.
they are hosted on a low cost vps provider so maybe their ranges are common low hanging fruit.
- throwaway613834 9y agoI wouldn't have revealed the exact port number here, but thanks :) yeah, I think your explanation sounds plausible.
- firethief 9y agoA port number isn't a real secret, it just screens out the bulk of mass scans. There's no point trying to hide it from targeted attackers.
- user5994461 9y agoThe hosting providers have known IP ranges and they are scanned permanently. I wouldn't be surprised if some guys had a rule to try 8022 and the most common non standard ports.