How do attackers find the IP addresses of recently deployed servers?

Question

About two months ago, I deployed an Ubuntu server with as main purpose serving a web app. However, I'm still developing the app and only gave the server IP to my coworker and some friends for testing.

Yesterday I checked the fail2ban logs and noticed many SSH bruteforce attempts from China, France etc. that dated to before I gave out the IP. I also checked my server access logs and noticed some malicious attempts on URLs from the same IPs, trying to bruteforce SSH. One example of a request they made is myip/otherip/file.php. I'm not sure how to interpret this. I traced back the IP of that server and it's on the same hosting company I'm on.

Question: How did they find out about the IP of the server before I even served the app from it or gave it out?

My guess: I'm guessing it is some bot that keeps trying on different IPs of some pattern that leads to servers of the same hosting company. Is that a correct assumption, or are there other possibilities?

Answer 1

Your guess is likely correct.

The big server hosters have continuous IP ranges from which they assign IPs to their customers. Low budget hosters are frequently used by amateurs who don't know what they are doing, so it's likely that they use easy to guess passwords or set up insecure web applications. This makes these IP ranges valuable targets for black-hats.

When you notice such attacks from within the hosters network, you should report them to the hoster, because this is very likely a breach of the terms of use... or a server from another customers where the black-hats were already successful.

Answer 2

All servers using IPv4 addresses get some level of background noise in the form of automated scanning and bruteforce attempts. This is basically because it is easy to scan the entire address space - it takes less than an hour, and can result in systems which haven't been fully patched or set up yet.

As a result, I would fully expect any system to see lots of this kind of traffic. This is why it is important to sort out your security before opening your server to the internet. Keep your firewall turned on, blocking any incoming traffic whilst setting it up. Restrict access to know IP addresses for testing. Once you are sure it's secure, then you can open the firewall to the rest of the internet to connect.

If you have a server with a reverse DNS lookup set, once someone has the IP address, they can look to see what domain name your system thinks it belongs to, hence the URL attempts too.

Basically, if you have made sure your system is secure, don't worry - make sure you've got decent passwords for SSH (or, better yet, key-based login), and that any other services are locked down properly. If you haven't, or you think they got in, treat it like a compromised server - sort out your firewall (probably with your hosting provider) and then start over.

Answer 3

Your IP is like a telephone number. There is no need to list it anywhere to be able to use it. In fact, it is already listed on the routing tables part of the BGP-protocol, the protocol that ISP's use for creating the 'internet'.

The Chinese (among others) are known to try any IP address in existence to see if a service is listening on it. Your server responded on one of their probes and then they try to infect you automatically. (basically what is known as a scripted attack)

The URL of your web site is just like listing your name in a telephone book, with the "number" you can be reached under. This will also be used by the Chinese as soon as you publish it, but it does not limit them to try to get in before.

Answer 4

In America, arin.net is the public repository of IP address blocks and who they belong to. This information, as an example, helps sys admins dealing with spam, routing, or other issues with folks outside their networks. But it helps hackers too. A hacker looking for financial gain would probably leave touchy end-customers like the Justice Department, CIA, or military alone, and the arin.net directory helps to exclude those. Such a hacker would do better digging through the published ranges of GoDaddy, Amazon, DigitalOcean, Linode, and Rackspace.

Each continent has its own directory similar to arin.net.

You may as well count on unwanted visitors, and prepare accordingly.

Answer 5

This is really two questions.

1.) How did they find out about your IP before you even setup the server ?

As other people have pointed out this probably was just some bulk scanning and not something specifically targeted to you specifically. There are tools like ZMAP which can scan the entire IPv4 Internet in just a matter of minutes.

https://zmap.io/

There are a lot of people gathering information about the Internet as a whole some simply for commercial or research purposes but also a lot of bad actors doing this as well. This is considered normal for the Internet and it's not uncommon for you to have your first scan by a third party within 2-4 minutes of connecting any computer to the Internet.

Note: Look carefully at the logs on your server and you will also find people using one attack method. These are bad actors that have a way to break into certain servers with a given configuration looking for vulnerable systems. This happens all the time.

2.) How do attackers find the IP addresses of recently deployed servers?

There are a number of ways that this can be done, the most common are as follows:

Use a brute-force dictionary attack tool to find all the hosts listed in an organizations external DNS (or mis-configured internal DNS). A tool that does a great job of this is THC Hydra https://github.com/vanhauser-thc/thc-hydra

If it's a large organization you can look at the companies AS number and find the associated IP addresses (IP Prefix) for their BGP peering at any number of router looking glasses

https://www.us.ntt.net/support/looking-glass/

Do note that this will only show you their main IP ranges and not servers they manage which may be located at a remote cloud provider

Another method is to download a complete listing of the reverse DNS for all IP addresses in the IPv4 address space.

https://scans.io/study/sonar.rdns

This also wont find everything but it will find many sites hosted at various cloud providers and may help to find other network ranges or third-party companies that work with a given organization

Finally. Simply using search engines. Search engines which discover all of the HTML and text on websites are a GREAT way to find related servers a company is setting up even if there is no corresponding DNS entry. As a penetration tester I routinely find copies of websites or content management systems hosted by web development teams which I can use to either access the companies main website or in some cases use to access the web browsers of people who work at a specific organization.

Additionally some websites will reference other servers a company owns by showing the URL to the other server. So scrapping all the publicly available website html and then searching for IP's and domain-names within that can also reveal more information.

Likewise mobile-app's and custom software applications leak this type of information as well.

In the process of doing reconnaissance for penetration testing it's typical to check all of the above to discover additional attack surface. Bad actors can do the same thing and bad actors who are well organized do this all the time using automated tools.