In the past 15 days 57,000 unique Mirai IoT devices have attempted to connect and it’s constantly growing (180 new IPs/h). 88.9% come one time and never come back. We have checked. It’s Mirai botnet, but why this way? They don’t attack. Is it a countdown? What will happen when all of them identified themselves?
It's a big server (64 cores, 18TB hdd, 1Tbps) in a datacenter and the 3 IP's are recent. This server has a firewall with Telnet closed (never used) and Fail2ban. I'm the owner of this server and I'm in a real terrorist and cyberterrorist context in Europe (Intelligence activity). So this situation can be really a sign of something else.