A week in the life of a Grey Noise Sensor: It's all about the tags

Summary: GreyNoise deployed new sensors in undisclosed network locations and, in the first week, tagged 8,697 incoming IP addresses, with the first packet of possible ill-intent arriving ten seconds after the nodes were fully operational and the first tagged event, an RDP Alternative Port Crawler, appearing three hours later. Over the seven days, non-benign nodes hit more than thirteen-thousand ports, most commonly those associated with Telnet, RDP, SSH and SMB, and an August 28th one-hour spike focused on SMB exploits originated from the Data Communication Business Group autonomous system in Taiwan.
What's compelling: The gap between ten seconds and three hours is the difference between a stray packet and a confirmed tagged intrusion, and it is the window in which an internet-facing system either holds or does not. GreyNoise also flags that hosting providers with decent IP reputation, including Linode, OVH SAS, Google LLC and Microsoft Corporation, appear among the malicious traffic sources, which means you cannot permanently block your way out of this.

Read the original at GreyNoise Blog ↗