Attacks Types of the Top Attacking IP Addresses

The top 50 IP addresses attacking systems in Canada were geographically spread fairly evenly. Eight percent are assigned to South Korea, and closely following, with 7% are assigned in the U.S. Though smaller in number, the three Canadian IP addresses in the top attacking IP address list are responsible for 17% of all attack traffic that targeted Canadian systems. These IP addresses were conducting a variety of activities, but most were scanning or doing some sort of credential stuffing.

Out of the top 50 attacking IP addresses, 65% were engaging in aggressive multi-port scanning ,32% participated in aggressive credential stuffing activity, and the remaining 2% were evenly distributed conducting HTTP attacks against port 8080, 8443, and 2375 and attempting to upload malware through SMB shares on port 445. The IP addresses in Moldova assigned to RM Engineering, as well as OVH SAS in France were launching brute force attacks and credential stuffing attacks against Remote Frame Buffer (RFB) / VNC port 5900, globally. All regions of the world were being hit with these same attacks from these IP addresses:

• 185.153.197.251
• 185.153.198.197
• 46.105.144.48
• 193.188.22.114
• 185.156.177.44
• 185.153.196.159
• 5.39.39.49
• 185.40.13.3

These port 5900 attacks were new activity we noticed earlier in the summer and continued through October 31, 2019. We have opened up a public threat hunting investigation on Twitter to uncover what is going on with these attacks and will be looking to share our findings and ask questions soon. Join the conversation on Twitter.

As mentioned, only 10% of IP addresses seen targeting Canada were exclusively targeting the region. This indicates that Canadian systems were likely not being geographically targeted but instead were being targeted based on the services they were providing. The following list is in descending order starting with top attacking IP addresses.

Table 2. Top attacking IP addresses in descending order

Top Targeted Ports

VNC port 5900 was attacked all over the world during this time period and was the number one attacked port in Canada by a large margin. This activity is not typical, hence the investigative threat hunting F5 Labs is doing on Twitter mentioned previously. In a distant second position was SMB port 445, also attacked all over the world. SMB port 445 is a common port where threat actors attempt to upload malware. The third most attacked port is SSH port 22, another commonly attacked port.

What stands out the most in top attacked ports in Canada is the targeting of SOCKS port 1080. That port does not show up in any other region during the same period, nor is it typically on a top 50 attacked port list.

In addition to some of the most commonly targeted ports, the number of non-standard HTTP port (8443, and 8080) targeting, and other application ports like Microsoft SMB port 445, and Microsoft CRM port 5555 makes it clear that attackers are targeting applications

Also noteworthy was the apparent attempt to compromise non-standard use of SSH and database by the targeting of ports 2222 and 33899 (along with 22 and 3389).