Trial by Internet

Intro

As part of developing one of our internal tools, we needed to have the latest data on what happens to the average server on the Internet. On a high level, we wanted to know the most commonly targeted services "in the wild", and the geographical distribution of the sources of these attempts.

We've set up a server and monitored network activities on it for a week. This post is a summary of our findings.

Results

• The server was set up with an external IPv4 address from AWS' IP pool for the ap-southeast-2 region
• Data was collected for every TCP connection attempts for 168 hours between 13/09/2020 and 20/09/2020. These included compromise attempts as well as simple port scans
• Overall, the server registered 58339 attempts. These came from 10103 different IP addresses
• We've managed to attribute ~20% of all attempts to Internet-wide security research projects and scanning engines like Shodan or Censys
• The events showed a fairly even distribution in time, without any significant burst

Targeted services

The 20 most targeted services were the following:

We see the usual suspects here (with some exceptions), mainly bots targeting remote management and other potentially high-value services.

The complete list of targeted services (with at least 10 connection attempts):

Geographical distribution

The complete geographical distribution of the attempts was the following:

According to IP geolocation, the following 20 countries originated the most attempts: