3 ms·
Take any given server. Log the IPs of invalid SSH attempts to access the machine over 3 months. Plot the IPs on a geolocation. Chinese originating IPs are the
by Supermancho 8y ago
Take any given server.
Log the IPs of invalid SSH attempts to access the machine over 3 months.
Plot the IPs on a geolocation.
Chinese originating IPs are the overwhelming number.
I posted my actual data years ago as a response to some comment, but I could just grab my recent logs and nothing has changed much (frequency, outliers, and some volume trading).
While the phrasing may be obtuse, it's a sentiment reflecting reality.
- auiya 8y agoIt would stand to reason. China has the largest number of endpoints, and thus is most likely to have the largest number of compromised hosts. I take it you've ruled out the possibility this is a geographically diverse spread of actors taking advantage of poor security practices on the large swaths of Chinese infrastructure in your logs?
- monocasa 8y agoChina has large numbers of pirated unpatched systems meaning that botnets have large presences in China, regardless of who's running their command and control.