3 ms·
> who keeps trying to log into your computer? I'm curious, how do you think this helps you answer the question? Proxies are incredibly easy to come by these da
by mmarian 8mo ago
> who keeps trying to log into your computer?
I'm curious, how do you think this helps you answer the question? Proxies are incredibly easy to come by these days, rotation makes it hard to identify what's behind it all.
- djkurlander 8mo agoThat’s a valid point. We can easily see where the attack is coming from but not who or which botnet. Some of these can be inferred by the pattern of usernames and passwords attempted, and the ISPs. Someone suggested that I collect the client SSH signature as well, which would help. But you’re right, we don’t know who is behind the attacks.
- mmarian 8mo agoI'm guessing the SSH signatures can rotate as well. I remember someone did an analysis of rotation patterns for HTTPS requests; that's when they saw some interesting clusters.
- prox 8mo agoI saw an ISP called Microsoft, USA… is that an official microsoft computer doing that or something else?
- djkurlander 8mo agoYes, Microsoft shows up a lot. Some of these bots are running on Azure. My favorite ISP to spot occasionally is SpaceX / Starlink. That can’t be the most economical ISP for bot traffic, but machines can be infected, even on Starlink.
- TurdF3rguson 8mo agoStarlink bot here, but you won't see me because I'm behind a VPN