5 ms·

>you're basically under constant probing So many chinese and russians IPs...

stjohnswarts 5y ago
I get a bunch of Indian IPs as well but probably 80% (non domestic) are russian or chinese for my ssh honeypot on port 22. USA scans are roughly 28%, I don't know if people outside the USA get hammered like that though. I keep it up just for fun. Minimal debian install with only SSH port 22 enabled and auto security updates (and a daily script to update and reboot) and you'd think that I had a fort knox full of gold in there lol. It's pretty insane how bots there are out there banging on the gates. It serves as a good reminder how goddamn hostile the internet is.
- throwanem 5y ago
  I've had VPSes hosted outside the US and not seen much difference in scan traffic, although it's been years and maybe things are different now.
- jandrese 5y ago
  I don't think the geo matters much. The bots seem to be scanning the entire IPv4 address space. This is the one big benefit I try to pitch to people who are considering IPv6. In all my years of log monitoring I have only ever seen a single bot attack my network over IPv6, and that was the one I manually programmed to make sure the detection system was working. The search space is just too large for the full internet sweeps that bots make.
  - 0x073 5y ago
    Every really relevant server has a ipv4 address. Why should bots try ipv6 if it works with ip V4. And I don't know how much bots scan the whole ipv4 address space, but doesn't they use up lists that are parsed from dns. ( SSL transparency report is a good start e.g.)?
consumer451 5y ago
> So many chinese and russians IPs... And S. Korean, and Dutch, I also recall significant attacks from Central America. For anyone interested in which geo's appear to be attacking you, and if you are a noob like me, pfelk is really cool: https://github.com/pfelk/pfelk https://github.com/pfelk/pfelk
collegeburner 5y ago
Lots of them, but more and more Brazilian and southeast Asian these days.

I get a bunch of Indian IPs as well but probably 80% (non domestic) are russian or chinese for my ssh honeypot on port 22. USA scans are roughly 28%, I don't know if people outside the USA get hammered like that though. I keep it up just for fun. Minimal debian install with only SSH port 22 enabled and auto security updates (and a daily script to update and reboot) and you'd think that I had a fort knox full of gold in there lol. It's pretty insane how bots there are out there banging on the gates. It serves as a good reminder how goddamn hostile the internet is.

throwanem 5y ago
I've had VPSes hosted outside the US and not seen much difference in scan traffic, although it's been years and maybe things are different now.
jandrese 5y ago
I don't think the geo matters much. The bots seem to be scanning the entire IPv4 address space. This is the one big benefit I try to pitch to people who are considering IPv6. In all my years of log monitoring I have only ever seen a single bot attack my network over IPv6, and that was the one I manually programmed to make sure the detection system was working. The search space is just too large for the full internet sweeps that bots make.
- 0x073 5y ago
  Every really relevant server has a ipv4 address. Why should bots try ipv6 if it works with ip V4. And I don't know how much bots scan the whole ipv4 address space, but doesn't they use up lists that are parsed from dns. ( SSL transparency report is a good start e.g.)?

consumer451 5y ago

> So many chinese and russians IPs... And S. Korean, and Dutch, I also recall significant attacks from Central America. For anyone interested in which geo's appear to be attacking you, and if you are a noob like me, pfelk is really cool: https://github.com/pfelk/pfelk https://github.com/pfelk/pfelk

collegeburner 5y ago

Lots of them, but more and more Brazilian and southeast Asian these days.