3 ms·
Over 90% of the ssh logins come from just a few China Telecom addresses. They just keep trying random ssh accounts over and over all day. I just geoblock China
by mianos 2y ago
Over 90% of the ssh logins come from just a few China Telecom addresses. They just keep trying random ssh accounts over and over all day. I just geoblock China now. Maybe occasionally unblock it for a few minutes if the kids want to buy something from Shien.
Then I honeypot the rest with the continuous ssh banner script.
- m0rde 2y agoWhat's a continuous ssh banner script?
- throwitaway1123 2y agoIt's a tarpit that slowly sends a message to bots to keep them (and their bandwidth, memory, and CPUs) occupied: https://github.com/skeeto/endlessh?tab=readme-ov-file https://github.com/skeeto/endlessh?tab=readme-ov-file