December honeypot report

First, the data from our Telnet & SSH honeypot. Unusually, Ireland is at the top place this month, followed closely by the USA:

graphic

Here is how the hourly activity looks like. The frequency with which the honeypot is being attacked has dropped significantly. Now we see averagely one attack every 1.5 seconds, while it used to be more than one attack per second in the past:

graphic

More than 63% of the attacks are via Telnet, the rest are via SSH. This marks a significant increase of the proportion of SSH attacks compared to the past:

graphic

The top-5 URLs from which malware was most actively uploaded to the honeypot. Mirai variants all of them, as usual, although the original variant is not among them:

graphic

Indeed, as you can see, uploads of various Mirai variants (IMO, "Svirtu" is a Mirai variant too) dominate heavily. The only exceptions are two generic downloaders (Downloader-AAN and Downloader-JS), and a Gafgyt variant:

graphic

Details about the top-20 most actively attacking IPs:

graphic

The top-20 most actively attacking organizations. Somewhat troubling is the presence of Microsoft at the top-2 spot. It seems that their Azure cloud has started being abused heavily. DigitalOcean is a distant third:

graphic

Speaking of DigitalOcean, as you can see, I've been sending them averagely more than 45 abuse reports every day but it doesn't seem to be helping very much:

graphic

The top-20 passwords that are the most often used by the attackers; nothing unusual here:

graphic

Moving on to our SMB honeypot.

First, the big picture. Vietnam has the top spot again, by a large margin. India and Russia follow far behind:

graphic

Hourly activity, showing on average more than 2.5 attacks per second; pretty steady traffic - and again more than against the Telnet & SSH honeypot:

graphic

Unique uploaded malware variants, according to Symantec's scanner. The corrupted WannaCry variants (no kill switch check, no encryption) dominate, as usual, although their total number has decreased significantly:

graphic

Even if we don't count only the unique variants, WannaCry is well-represented:

graphic

Details about the top-20 most actively attacking IPs. Nothing unusual here:

graphic

The top-20 organizations from which most of the attacks are coming from. Nothing unusual here, either:

graphic

Next, the data from our ADB honeypot.

The big picture. This month the Netherlands holds the top spot again:

graphic

The hourly connection data, showing averagely 2.9 attacks per hour:

graphic

The unique malware uploaded to the honeypot, according to Fortinet's scanner. The two parts of same old Monero mining worm (Trinity) plus some generic malware:

graphic

Details about the top-20 most actively attacking IPs:

graphic

The top-20 organizations that own the IP addresses attacking us:

graphic

Next, moving to the Remote Desktop Protocol honeypot.

First, the big picture. The USA is at the top spot this month, although Russia and Germany are close behind:

graphic

Hourly activity, showing 4 attacks per minute:

graphic

Details about the top-20 attacking IP addresses:

graphic

The top-20 organizations that own the IP addresses attacking us. Microsoft's Azure is being heavily abused for this kind of activity (RDP scanning), too:

graphic

Moving on to our Elasticsearch honeypot.

First, the big picture. The USA has displaced China from the top spot this month:

graphic

Hourly activity, showing 3 attacks per hour:

graphic

The scans dominate although there is a significant number of attempts to exploit the seemingly vulnerable server and to run code on it (mostly a crypto miner). There are also a few unusual scans using a HEAD request; probably somebody's overly cautious vulnerability scanner:

graphic

Details about the top-20 IP addresses that have connected to the honeypot:

graphic

Information about the top-20 organizations that own the IP addresses attacking the honeypot:

graphic

The top-20 queries most often used by the attackers:

graphic

The payloads most often used by the attackers. Mostly trying to install a Monero miner (there is probably a worm or a botnet that does this):

graphic

Finally, moving to our Internet Printer Protocol honeypot.

First, the big picture. This month, too, not all attacks come from the USA - there is one from Poland as well. (There are also generic HTTP hits from other countries as well - from machines that scan random IP addresses for the presence of an HTTP server on any port - but I have filtered only the attacks which explicitly use the IPP protocol.)

graphic

The attacks come roughly once every couple of days. So far they have been only scans - the attackers are using only the Get-Printer-Attributes operation and are not actually trying to print anything:

graphic

Details about the top-20 IP addresses scanning the honeypot. As you can see, almost all of them are in the USA and belong to a very small set of ISPs. Each address has scanned the honeypot only a few times, though (1-3), suggesting that whoever is doing this (probably Censys), is rotating VMs at these ISPs when doing the scanning from them:

graphic

Information about the top-20 organizations that own the IP addresses attacking the honeypot - except that there are only 7 different ones:

graphic

This concludes the December honeypot report.