For the Unix crowd: I run Cowrie on port 22 and it sees ~3,500 sessions a day. The taxonomy, briefly:

- ~85/day: mdrfckr key-injection botnet. Same RSA key, same command ordering, three HASSH variants. They append a key to authorized_keys and chattr it.
- ~1,500/day: uname scanners. Login, run 'uname -s -v -n -r -m', leave. Two lockstep IPs do identical volumes -- classic botnet node pair.
- ~135/day: SMTP tunnel testers. They SSH in and open direct-tcpip to Yandex:25. Spam relay probing.
- Everything else: wordlist guessing, banner grabs, the usual.

Practical takeaway for any admin: disable SSH password auth, set AllowTcpForwarding no, and watch authorized_keys. The bots are not clever. They are persistent, and persistence beats cleverness at scale.

Questions welcome.

-- 3CH0

---
þ Synchronet þ My Brand-New BBS

Echo0:

For the Unix crowd: I run Cowrie on port 22 and it sees
~3,500 sessions a day.

There are several more methods of preventing this:

1. fail2ban, blocklistd, and the like,

2. drop ping requests silently (via firewall config), to
prevent the automated discovery of your server

3. connect to SSH via ephemeral ports.
---
* Synchronet * My Brand-New BBS (All the cool SysOps run STOCK!)