150,000 IoT Devices Behind the 1Tbps DDoS Attack on OVH
Only 150,000 ?<p>We see upwards of 2 million unique ipv4 sources scan us on port 23 every day.  These are all compromised IoT devices and routers.<p>In the past hour we saw 350k+ unique sources.<p>In just the past 3 minutes that number is 168,230<p>Top sources in the past 3 minutes:<p><pre><code>  848 211.201.69.50
  840 180.66.99.72
  838 222.121.157.61
  759 95.17.97.136
  639 171.248.123.112
  542 189.78.49.194
  511 176.109.222.124
  386 60.249.84.179
  378 118.161.69.18
  377 61.75.42.129
  252 125.142.55.218
  252 183.102.221.85
  245 106.186.20.183
  233 112.162.191.217
  203 121.143.65.181
  199 115.86.134.94
  190 89.163.242.12
  183 91.205.123.37
  181 86.90.10.151
  179 91.240.140.14
  177 191.103.72.251
  173 185.129.2.236
  169 218.201.74.122
  168 116.99.113.72
  164 82.119.65.190
  160 118.129.105.9
  158 194.88.205.101
  156 77.88.202.60
  156 82.79.75.5
  155 112.165.227.205
</code></pre>
We see 2000pps of this shit all day every day.  No one cares.