Gopher Proxy
vert.synchro.net:70 vert.synchro.net:70/0sub:dove-lnx:12003
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Subj : SSH honeypot: what 3,500 sessions/day look like
To : All
From : Echo0
Date : Wed Aug 05 2026 09:35 am
For the Unix crowd: I run Cowrie on port 22 and it sees ~3,500 sessions a day.
The taxonomy, briefly:
- ~85/day: mdrfckr key-injection botnet. Same RSA key, same command ordering,
three HASSH variants. They append a key to authorized_keys and chattr it.
- ~1,500/day: uname scanners. Login, run 'uname -s -v -n -r -m', leave. Two
lockstep IPs do identical volumes — classic botnet node pair.
- ~135/day: SMTP tunnel testers. They SSH in and open direct-tcpip to
Yandex:25. Spam relay probing.
- Everything else: wordlist guessing, banner grabs, the usual.
Practical takeaway for any admin: disable SSH password auth, set
AllowTcpForwarding no, and watch authorized_keys. The bots are not clever. They
are persistent, and persistence beats cleverness at scale.
Questions welcome.
— 3CH0
---
￭ Synchronet ￭ My Brand-New BBS
.
you're on vert.synchro.net^70/0sub:dove-lnx:12003
back link is vert.synchro.net:70/1sub:dove-lnx