SSH Honeypot — Research Report

The intuitive reading — "China is attacking us" — collapses on inspection. The data measures where compromised SSH-spreader infrastructure currently lives, not where the operators sit. Three structural conditions concentrate that infrastructure in CN + HK network space, and each is well-documented in the literature.

First, Alibaba Cloud HK uniquely permits password-based root SSH login on instances by default — a permissive posture repeatedly observed by Trend Micro^[72] and SonicWall^[154]. Cheap HK instances become trivially compromised and immediately convert into spreader nodes. Three of our top-15 attacker IPs sit in Alibaba Cloud HK; together they emit 33% of all events.

Second, the consumer-broadband pool that fed the original Mirai botnet in 2016 — millions of always-on, default-credential routers and ONTs — has not measurably shrunk in a decade. Antonakakis et al. measured 600k Mirai infections at peak^[22,155]; our 111.72.138.102 (ChinaNet broadband, 20,663 events) is a textbook 2026 example of the same population still being recruited.

Third, source-IP geolocation is a victim measurement, not an actor measurement. The IMC 2025 long-term SSH honeynet study^[151] makes this explicit: top source ASNs correlate with cloud-provider permissive defaults far more strongly than with country-of-operator. Blocking by country buys little; blocking by CIDR or ASN is what defeats the campaign.

The Mirai era (2016–2017) monetized compromised devices primarily through DDoS-for-hire and click fraud^[22,29,155]. From 2018 onward, the dominant payload shifted to Monero (XMR) mining via XMRig — a transition Pastrana & Suarez-Tangil documented at scale across 4.5M malware samples, attributing ~4.4% of all circulating XMR (≈$58M USD at the time of their measurement) to mining-malware campaigns^{[149,150,158]}. Our sensor captured the current dominant strain in that lineage: Redtail^[1,4,8,10].

The economic logic of choosing Monero over Bitcoin is unambiguous. XMR is CPU-mineable, so every captured architecture contributes revenue — a router, an IoT camera, and a server all become productive workers in the same pool. The chain is privacy-preserving by construction (ring signatures, stealth addresses), so the revenue stream is untraceable. And mining is entirely passive: no victim interaction, no extortion, no headline. The victim's only observable signal is a higher electricity bill weeks or months later.

Compared to ransomware — high per-host revenue but immediate incident response — cryptojacking has lower revenue per host but materially higher operator ROI at scale. Akamai's analysis of the long-running dhpcd miner shows the model: pennies per host per day, sustained across thousands of hosts, undetected for four years^[87]. Red Canary's 2024 detection-trends report names Linux coinminers as the single most prevalent threat against Linux hosts they observe^[94]. The four-architecture dropper our sensor caught is not an aberration — it is the modal payload of the current SSH-brute-force economy.

Modern Debian, Ubuntu and RHEL ship PermitRootLogin prohibit-password or stricter by default. So why do bots still try root in 22,814 out of every 24,000 attempts on this sensor — a pattern reproduced in honeypot study after honeypot study^{[34,39,151,153]}?

The brute-force economy is not tuned for hardened Linux servers. It is tuned for the firmware defaults of consumer routers, IoT, surveillance gear and legacy embedded systems, where root is frequently the only account that exists^[22,155]. Antonakakis et al. showed Mirai's success was driven entirely by ~60 default credential pairs against this exact population. Eight years later, the population has not been replaced.

The cost-benefit math also favors always-try-root regardless of target. A failed SSH attempt costs the attacker microseconds and a TCP handshake. A successful root login yields full control with no privilege-escalation step. When attempts are effectively free, the optimal bot strategy is to maximise the upside of the rare success — and the maximum upside is always root.

The mirror-image conclusion is the operationally important one: disabling root SSH on the production daemon would have blocked 95% of volume on this sensor. The data confirms what the Mirai literature warned in 2017 — bots have not adapted to that single mitigation in nearly a decade. The defender's cost is one sshd_config line; the attacker's cost of working around it is the entire economic model.

The top-15 attacker list contains three IPs from 45.153.34.0/22 plus a fourth from the adjacent 45.156.84.0/22 — all assigned to IT7 Networks Bulgaria^[105,106], all running identical credential lists and identical command sequences. Two further entries (176.65.132.24 and 185.217.1.246) sit inside Aeza Group, the Russian bulletproof hoster sanctioned by the US Treasury and the UK NCA in July 2025^[40,41,44].

This is the signature of bulk VPS provisioning: an operator rents an entire CIDR slice from a hoster and launches the same bot from every address in it. The selection of hoster is not incidental. Aeza was explicitly sanctioned because its terms of service refused takedown requests — a structural feature, not an oversight^[42,46,48]. IT7 Networks has been ThreatFox-tagged for the same pattern^[105].

The implication for defensive feeds is direct: IP-level blocklists decay rapidly because the operator simply moves to the next /32 in the same block. ASN- and CIDR-level filtering remains effective for weeks to months, because the operator's cost of switching hosters is materially higher than the cost of recycling individual IPs. This is the empirical reasoning behind the Spamhaus and abuse.ch listing model^[105,108], and our 8-day dataset reproduces it cleanly.

The SSH brute-force ecosystem on the public internet is so concentrated — a small set of campaigns, a small set of operators, a small set of hosting networks — that a single sensor independently reproduces findings published by Cisco Talos^[127] (12M brute-force attempts in 11 days, single actor briefly ≈ 33% of all internet SSH activity), Akamai^[10,87], Forescout^[1], Elastic Security Labs^[3], GreyNoise^[120,122], Shadowserver^[80], SANS ISC^{[4,32,34,156]}, MITRE ATT&CK^{[16,18,137,138]}, and the IMC academic studies of 2019 and 2025^[149,151].

For research practice this matters: SSH-honeypot findings generalize. The marginal cost of becoming a contributing node in the public IOC ecosystem is one VPS-month of compute — effectively zero. The "Analysis of Honeypots" arXiv survey^[152] makes this explicit as a reproducibility property: even a single sensor produces statistically stable distributions for the top campaigns within days.

For operational security the implication is sharper. Internal-network honeypots — deployed alongside, not in place of, commercial threat-intel feeds — are cheap, evidence-rich, and produce locally-grounded IOCs that commercial feeds cannot supply, because they do not see local traffic. The recent IMC 2025 long-term honeynet paper^[151] argues directly that the marginal value of organisation-internal honeypots has been consistently underestimated by enterprise security programs. The data presented here is a small confirmation of that thesis.