Intelligence View

⚡ tsecurity.de Intelligence

Strange SSH connections

Yesterday I checked my server's stats for the first time in a while, because I've been busy, and noticed that there was some strange traffic, so I looked a little more closely and found that there were ~65 SYN_RECV TCP connections active…

Linux Tipps & Hardening reddit.com 16.08.2022, 08:17 Uhr 2 Min. Lesezeit Cloud & IT-Enterprise

↗ Quelle (reddit.com)

Reagiere als Erste:r — dein Feedback zählt!

STANDARD — Regulärer Patch-Zyklus ~2 Min. (359 W.)

Deep Tech

Strange SSH connections

Angriffsfläche

Enterprise IT / Cloud Infrastruktur

Exploit-Status

Geringe Ausnutzungswahrscheinlichkeit / Keine aktiven Kampagnen

Sofortmaßnahme

Asset-Inventar prüfen & Upstream-Advisory überwachen

Strange connections

My first thought was that someone was trying to gain access to my server, but that would raise even more questions, since I have my firewall set up in such a way that after 3 failed attepts trying to enter a password it won't accept a new connection from your ip for an hour, and while there are dips in the number of connections, those might also be a result of the the storms in my area, since I get internet from a wireless provider.

Also, this seems to have started right around a week ago so it's been going on for 7 days and in that time I've seen an increase over the normal daily average bandwidth and it's been ramping up slowly, from ~80MB the first 3 days to now seeing over ~220MB of traffic more than usual, though it might not be entirely from these ssh connections.

Total traffic

Total network packets

SSH Traffic

All of these connections come from a few IPs, I've looked them up and they're all from different datacenters around the world:

185.50.70.28 Osbil Technology Ltd., Turkey

34.246.4.96Amazon Data Services Ireland Limited, Ireland

8.212.183.33 Alibaba.com Singapore E-Commerce Private Limited, Philippines

42.236.136.163 China Unicom Henan Province Network, China

20.239.65.52 Microsoft Corporation, Hong Kong

43.142.110.118 Tencent Cloud Computing (Beijing) Co. Ltd, China

51.79.146.79 OVH Singapore Pte. Ltd, Singapore

This is even stranger to me because I would've thought that if it were some sort of attack, whoever's behind it would have used compromised home machines or something like that and certainly not cloud computing services from 7 different companies in 7 different locations around the world, right?

So, is it really an attack, and if not, what is going on?

For now, just for precaution, I've decided to remove port forwarding for the ssh port from my router.

submitted by /u/Nik16_YT
[link] [comments]

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

Syntax validiert (0 Fehler)

title: Detect Exploitation - Strange SSH connections
id: c12d5168-3859-4c91-88d2-7ec969647772
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      DestinationIp:
        - '185.50.70.28'
        - '8.212.183.33'
        - '42.236.136.163'
        - '20.239.65.52'
        - '43.142.110.118'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "Strange SSH connections" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
(dest_ip="185.50.70.28" OR dest_ip="8.212.183.33" OR dest_ip="42.236.136.163" OR dest_ip="20.239.65.52" OR dest_ip="43.142.110.118")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

destination.ip: ("185.50.70.28" OR "8.212.183.33" OR "42.236.136.163" OR "20.239.65.52" OR "43.142.110.118") and event.category: "network"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where DestinationIP in ("185.50.70.28", "8.212.183.33", "42.236.136.163", "20.239.65.52", "43.142.110.118")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

IoC Intelligence (6 Indikatoren)

185[.]50[.]70[.]288[.]212[.]183[.]3342[.]236[.]136[.]16320[.]239[.]65[.]5243[.]142[.]110[.]11851[.]79[.]146[.]79

CTI Threat Relationship Graph6 Knoten / 5 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

Nur für kurze Zeit: 50 Prozent Rabatt auf alle Videokurse der heise Academy

IT Security Nachrichten

NÄCHSTER BEITRAG 1 Min

Is there a summary documentation somewhere of the "new generation" of sysadmin-y Linux commands?

Linux Tipps & HardeningWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Analyse für identifizierte Bedrohung auf Basis von Live-CTI (ENISA EUVD): CVSS 0.0 · EPSS 0.0% · CISA KEV: nein. Handlungsableitung aus den verlinkten Hersteller-Quellen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

Schnell-Prompts für Analysten

Echtzeit-Radar & Feeds

👥 Community & Social

🕒 tsecurity.de Such-Trends & Chronologie

Strange SSH connections

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

2. Cyber Threat Intelligence & Forensik

MITRE ATT&CK Matrix Navigator 14 Taktiken

tsecurity.de Cognitive Threat RAG

Auch interessante Nachrichten Strange SSH connections

NYT Connections hints and answers for Sunday, September 20 (game #1197)

What YouTubers do y'all watch?

What breaks when you self-host a TURN server (coturn — symptom, cause, fix)

No Board of Directors Will Ever Accept "The AI Hallucinated": The Blame Deficit in Software Engineering

Gemini Hacked Three Companies Using the Dumbest Trick in the Book

Fake-URLs erkennen: FRITZ!Box-Hersteller zeigt, wie ihr Phishing-Mails sofort entlarvt

tsecurity.de LIVE

Echtzeit-Radar & Feeds

👥 Community & Social

Strange SSH connections

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

2. Cyber Threat Intelligence & Forensik

MITRE ATT&CK Matrix Navigator 14 Taktiken

Mehr aus dieser Kategorie

tsecurity.de Cognitive Threat RAG

Auch interessante Nachrichten Strange SSH connections

NYT Connections hints and answers for Sunday, September 20 (game #1197)

What YouTubers do y'all watch?

What breaks when you self-host a TURN server (coturn — symptom, cause, fix)

No Board of Directors Will Ever Accept "The AI Hallucinated": The Blame Deficit in Software Engineering

Gemini Hacked Three Companies Using the Dumbest Trick in the Book

Fake-URLs erkennen: FRITZ!Box-Hersteller zeigt, wie ihr Phishing-Mails sofort entlarvt

tsecurity.de App