Hacker News Reader

Comment by mariusmg | Hacker News Reader

>you're basically under constant probing

So many chinese and russians IPs...

I get a bunch of Indian IPs as well but probably 80% (non domestic) are russian or chinese for my ssh honeypot on port 22. USA scans are roughly 28%, I don't know if people outside the USA get hammered like that though. I keep it up just for fun. Minimal debian install with only SSH port 22 enabled and auto security updates (and a daily script to update and reboot) and you'd think that I had a fort knox full of gold in there lol. It's pretty insane how bots there are out there banging on the gates. It serves as a good reminder how goddamn hostile the internet is.

I've had VPSes hosted outside the US and not seen much difference in scan traffic, although it's been years and maybe things are different now.

I don't think the geo matters much. The bots seem to be scanning the entire IPv4 address space. This is the one big benefit I try to pitch to people who are considering IPv6. In all my years of log monitoring I have only ever seen a single bot attack my network over IPv6, and that was the one I manually programmed to make sure the detection system was working. The search space is just too large for the full internet sweeps that bots make.

Every really relevant server has a ipv4 address. Why should bots try ipv6 if it works with ip V4.

And I don't know how much bots scan the whole ipv4 address space, but doesn't they use up lists that are parsed from dns. ( SSL transparency report is a good start e.g.)?

> So many chinese and russians IPs...

And S. Korean, and Dutch, I also recall significant attacks from Central America.

For anyone interested in which geo's appear to be attacking you, and if you are a noob like me, pfelk is really cool:

https://github.com/pfelk/pfelk

Lots of them, but more and more Brazilian and southeast Asian these days.

Reply on news.ycombinator.com