Build1 publisher3 min readPublished Updated
Three undisclosed cloud hosts fielded 3,480 probes in 45 minutes
A developer rented boxes in Frankfurt, New York and Singapore, told nobody the addresses, and counted the knocks. One host on Korea Telecom's network sent nearly half the packets, so the background rate only appears once you subtract it.
The Engineer · Build desk
What happened
- Three servers rented in Frankfurt, New York and Singapore were kept out of DNS, certificates, repositories and chat, leaving only the hosting providers aware that the addresses were in use.
- The Singapore box drew its first uninvited connection 48 seconds after it booted, and Frankfurt's first arrived at 107 seconds.
- Over about three quarters of an hour the three hosts logged 3,480 connection attempts from 860 different addresses, including 1,085 attempts to log in with a real password.
- One host on Korea Telecom's network sent 1,663 packets to the Frankfurt box alone, nearly all of them to telnet, hammering a single machine instead of scanning.
- Of the 860 addresses, 672 sent exactly one packet in the whole window, which the author reads as wide, shallow scanning that touches an address and moves on.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- contradiction The raw totals make Frankfurt look 4.5 times more hostile than Singapore, and a single address accounts for nearly all of that gap, so per-region rankings drawn from a 45-minute capture will not survive a second run.
- exposure The credentials being tried are embedded-device defaults and backdoors, so the population this traffic actually opens is routers, cameras and DVRs still carrying them, reached over telnet and Android Debug Bridge.
- cost Under three cents of instance time bought 135 box-minutes of measurement, which puts the background rate for a given provider's ranges within reach of any team that wants its own number instead of this one.
The most useful part of the run is the part that broke. A bot connects to the telnet listener, sends a username, then waits for the server to negotiate telnet options before it sends a password [17]. The first version of the prompt did not answer that negotiation, so the early data was a pile of usernames with nothing behind them [17]. Answering the option negotiation the way a real telnet daemon does fixed it, and the passwords arrived [17]. A honeypot with that bug logs connections and usernames as normal, then reports zero credentials.
Three regions at roughly 45 minutes each is 2.25 hours of instrumented IP time [7][1]. Spread over that, 3,480 attempts is about 1,547 per IP-hour [2]. Most of it is one machine. The Korea Telecom host's 1,663 packets are 48% of everything logged and 72% of Frankfurt's total [4][5]. Subtract that host and the rate is about 808 per IP-hour [3]. "That is the real number I would quote: a fresh public IP, anywhere, fields somewhere around 700 to 800 unsolicited connection attempts an hour from the general noise, plus the occasional individual who decides to lean on you," the author wrote [11].
With that host removed, Frankfurt drops to 662 attempts [7]. New York, which the write-up does not total directly, is 639 by subtraction [6]. Singapore stays at 516 [9].
672 of the 860 distinct addresses sent exactly one packet in the whole window [12]. Counting one packet as one attempt, the other 188 addresses account for 2,808 attempts between them, about 15 apiece [8].
The port ranking names the population. Telnet on 23 leads by a wide margin once the Korea Telecom host is included [13]. Port 8088, which is Hadoop YARN and assorted admin panels, was steady on every box and came from many sources [13]. Port 5555 is Android Debug Bridge, and SSH on 22 was constant without being dramatic [13]. On New York one host tried mail submission on 587 and 465 fifty times each, which the write-up reads as spam preparation on an IP nobody has reported yet [14]. The 1,085 password attempts covered 107 distinct username and password pairs, about ten tries per pair [16][9]. 7ujMko0admin is a Dahua camera backdoor and Zte521 is a ZTE router default [18].
For 800 attempts per IP-hour to describe your host, the address has to be a routable cloud IP in a range that scanners enumerate continuously, measured over an hour or two, with the one determined host taken out. The run does not support more than that. It covered about 45 minutes per region on a single afternoon, so there is no time-of-day curve in it and no provider-to-provider comparison. It does rule out a stale pointer as the explanation: the HTTP traffic was almost all bare requests to / with no Host header, and the few requests carrying a real hostname matched nothing a previous tenant of those IPs might have run [15]. On the timing, the author wrote: "Whatever you were planning to harden after the demo works is already being probed." [8]
What to watch
- A multi-day run would show whether 808 attempts per IP-hour holds across time of day, or whether the afternoon window flattered it.
- A repeat across two or more providers would show whether scanner attention tracks the address block rather than the region.
- The published port and credential tables are truncated in the write-up; the full lists would let the per-port rates be checked independently.