October honeypot report
First, the data from our Telnet & SSH honeypot. Again, the UK is way ahead of everybody else and usual favorite, the USA, is a distant second place with less than half as many attacks coming from there:
Here is how the hourly activity looks like. The frequency with which the honeypot is being attacked, while still very high, continues to drop. It is now down to 1.28 times per second:
More than 83% of the attacks are via Telnet, the rest are via SSH:
The top-5 URLs from which malware was most actively uploaded to the honeypot. Mirai variants all of them, as usual, although the original variant is not among them. Some idiot is using his Mirai botnet to solicit subscriptions to his YouTube channel. One nice day this is going to bite him in the ass when the authorities get around to subpoenaing Google for his location.
Indeed, as you can see, uploads of various Mirai variants (IMO, "Svirtu" is a Mirai variant too) dominate heavily. The only exceptions are four generic downloaders (Downloader-AAN, Downloader-JS, Downloader-AEH, Agent-AGS, and Downloader-AEH) and Gafgyt-KS:
Details about the top-20 most actively attacking IPs. You can see why the UK is at the top of attacking countries:
The top-20 most actively attacking organizations. Unusually, DigitalOcean doesn't occupy the top spot this month, either, but has managed to keep the honorable second place:
Speaking of DigitalOcean, as you can see, I've been sending them averagely more than 51 abuse reports every day:
The top-20 passwords that are the most often used by the attackers; nothing unusual here:
Moving on to our SMB honeypot.
First, the big picture. Vietnam has the top spot again, although Russia is again very active:
Hourly activity, showing on average around 2.26 attacks per second; pretty steady traffic - and again more than against the Telnet & SSH honeypot:
Unique uploaded malware variants, according to Symantec's scanner. The corrupted WannaCry variants (no kill switch check, no encryption) dominate, as usual, although their total number has decreased significantly. Also, seeing the Eternalrocks worm still alive is somewhat unusual, unless this is a misidentification:
Even if we don't count only the unique variants, WannaCry is well-represented:
Details about the top-20 most actively attacking IPs. Nothing unusual here:
The top-20 organizations from which most of the attacks are coming from. Nothing unusual here, either:
Next, the data from our ADB honeypot.
The big picture. This month the USA again holds the top spot, displacing China:
The hourly connection data, showing averagely 2.2 attacks per hour:
The unique malware uploaded to the honeypot, according to Fortinet's scanner. The two parts of same old Monero mining worm (Trinity) is causing all the identified malicious uploads:
Details about the top-20 most actively attacking IPs:
The top-20 organizations that own the IP addresses attacking us:
Next, moving to the Remote Desktop Protocol honeypot.
First, the big picture. Russia firmly holds the top spot this month:
Hourly activity, showing 2.25 attacks per minute:
Details about the top-20 attacking IP addresses. You can see why Russia is occupying the top spot:
The top-20 organizations that own the IP addresses attacking us:
Moving on to our Elasticsearch honeypot.
First, the big picture. The USA has again managed to displace China this month:
Hourly activity, showing an attack every half an hour:
The scans dominate although there are a significant number of attempts to exploit the seemingly vulnerable server and to run code on it (mostly a crypto miner). There are also a couple of unusual scans using a HEAD request; probably somebody's overly cautious vulnerability scanner:
Details about the top-20 IP addresses that have connected to the honeypot. You can see at the top the Chinese IP address whose entire purpose in life seems to be periodically scanning the Internet for open Elasticsearch servers:
Information about the top-20 organizations that own the IP addresses attacking the honeypot:
The top-20 queries most often used by the attackers:
The top-10 payloads used by the attackers. Mostly trying to install a Monero miner (there is probably a worm or a botnet that does this):
Finally, moving to our Internet Printer Protocol honeypot.
First, the big picture. For the first time, not all attacks come from the USA - there is one from China as well. (There are also generic HTTP hits from other countries as well - from machines that scan random IP addresses for the presence of an HTTP server on any port - but I have filtered only the attacks which explicitly use the IPP protocol.)
The attacks come roughly 3 times per day. So far they have been only scans - the attackers are using only the Get-Printer-Attributes operation and are not actually trying to print anything:
Details about the top-20 IP addresses scanning the honeypot. As you can see, almost all of them are in the USA and belong to a very small set of ISPs. Each address has scanned the honeypot only a few times, though (1-5), suggesting that whoever is doing this (probably Censys), is rotating VMs at these ISPs when doing the scanning from them:
Information about the top-20 organizations that own the IP addresses attacking the honeypot - except that there are only 8 different ones:
This concludes the October honeypot report.