Re: SFTP question

[Sven Hartge <sven@svenhartge.de>]

Danny <mynixmail@gmail.com> wrote:

>> I've seen attacks start within hours of putting a new system on the
>> internet.  I see multiple attacks on my servers every day.

> Makes me wonder how these guys get hold of IP's so quickly ...

With a decent enought connection (about 10GBits) you can scan the entire
reachable Internet withing about 30 Minutes to check for the openess of
one port. (See the programm masscan.)

And there are bots, lots of bots who also tirelessly scan the whole IPv4
range for open SSH-, SMTP-, POP3-, IMAP- and HTTP-Ports.

I for example have blacklisted 116.10.191.0/24 (from the Chinanet AS)
because for at least the last 7 years there have nothing but port scans
been comming from that network.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.