In the past 15 days 57,000 unique Mirai IoT devices have attempted to connect and it’s constantly growing (180 new IPs/h). 88.9% come one time and never come back. We have checked. It’s Mirai botnet, but why this way? They don’t attack. Is it a countdown? What will happen when all of them identified themselves?

It's a big server (64 cores, 18TB hdd, 1Tbps) in a datacenter and the 3 IP's are recent. This server has a firewall with Telnet closed (never used) and Fail2ban. I'm the owner of this server and I'm in a real terrorist and cyberterrorist context in Europe (Intelligence activity). So this situation can be really a sign of something else.

enter image description here

  • 1
    They are trying to attack you (they are attempting to connect to your Telnet port). Something on your network made it so the botnet registered your IP as being a vulnerable IoT device, and they are trying to log in. – schroeder Jan 10 '17 at 7:34
  • No, I don't think so. 180 new IP every hours, days and night for 1 to 3 packets only and since 15 days, that's not an attack. Definitively not. It's too much constant. – T. Grandier Jan 10 '17 at 7:37
  • 4
    Define 'attack'. You mean a DDoS. I mean an attempt to gain access without authorization. – schroeder Jan 10 '17 at 7:41
  • I just changed the question's description above. Please take a look on it. Strictly 180 unique attempts per hour since 350 hours??? I could believe if it was sometimes 50 attempts, sometimes 450. No, it's 170-190 attempts each hour during 350 hours, non stop. – T. Grandier Jan 10 '17 at 7:56
  • 3
    You only added details of your server to your question. That doesn't change anything, except that the IPs are recent. The previous owners of the IP may have been a C&C and its bots are trying to connect. – schroeder Jan 10 '17 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.