I heard that if you use an old Windows XP and your computer is connected directly to the internet with its own IP, you get a trojan within hours because the complete internet ipv4 range is regularly scanned by automated attackers.

Would this be possible?

And how likely is this happening?

  • check your router's logs, you can see the vast numbers of scans hitting your very own connection
    – schroeder
    Sep 12, 2016 at 20:24
  • Start Wireshark/tcpdump on a network interface connected to the public Internet and watch. You'll be horrified. Sep 12, 2016 at 23:57

1 Answer 1


I can't comment on Windows XP as such but I can say that if you add a new connection to the internet, common ports will start being scanned certainly within 30min and sometimes within seconds.

This is not theoretical but actual.

As for XP getting a trojan, that is perhaps a little less likely unless you were to connect up an unpatched version of XP - maybe one that had been offline for a couple of years. But I've not tried it so I can't say for sure. If you have the kit lying around, why not try it?

  • 2
    Some stats: In 36 hours on an internet facing server (that isn't running any website or anything like that): There were 36595 failed login attempts since the last successful login.. This is a root honeypot login over sshd (port 22). So I'd argue it is almost one request every two seconds.
    – grochmal
    Sep 12, 2016 at 22:19
  • Nice stats, thanks for sharing. I never connect port 22 to the Internet, I always move SSH to a non-standard port. Otherwise you can't spot any actual problems in your logs for the continuous hacking attempts. Sep 13, 2016 at 5:41
  • If this stat is on a honeypot that is well known and was set up it is not very representable, because the attacks were not causet by an IP-Range scan. you would need a server with an IP that isn't known anywhere to only catch IP-Range-Attacks
    – rubo77
    Sep 13, 2016 at 8:45
  • I think the point is that it is easy enough to test and demonstrate the real risks. Automated attacks are continuous and highly prevalent. That is unquestionable. To get an infection (rather than "just" a break-in), the machine would need to be either vulnerable to malware that can attack over the Internet or would need to be vulnerable to a remote command/login that might put malware onto the device. Much less likely even between the 2 options but certainly not impossible. Sep 13, 2016 at 8:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .