I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect.

I'm thinking this is just some kind of scan to see if it's really SSH or to make sure it's not using cert based auth but I don't understand why it wouldn't start a brute force.

I've been looking through some of the source code for botnets I have found nothing that would suggest they would only test a connection.

I don't have much experience with actually setting up a botnet so any explanations or source code you might have would be really helpful.

  • There are many other processes at play besides botnets. You don't need a botnet to scan.
    – schroeder
    Oct 4 '18 at 10:14
  • Might as well be someone searching a specific message pattern after connect, e.g. someone looking for a vulnerable sshd or another service running at port 22.
    – Ben
    Oct 4 '18 at 10:25
  • I realise you don't need a botnet to scan but a port scan doesn't create a connection event. Considering the amount of connections and the SSH client versions used, it looks like a bot.
    – Derezzed
    Oct 4 '18 at 20:33

I used to run a few honeypots and that's the typical pattern:

  1. scans seek out valid services
  2. processes bruteforce the services then immediately log out without taking action
  3. attackers log in and perform actions

In many cases, the 3 phases could occur days apart from each other. IPs between the phases would never correlate, and the attackers would log in with the correct credentials the first time.

It was as though there were "scout" robots finding servers, botnets bruteforcing them, then verified credentials sold or distributed to attackers.

  • This is what I'm seeing as well. It makes sense that they would use this technique as a mitigation against programs like fail2ban but I can't find any hard evidence.
    – Derezzed
    Oct 4 '18 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.