The mcblockd automation has been running for roughly one week. It’s been fairly busy automatically blocking those trying to crack my ssh server. Below is some of the output from a query of the active blocked networks (the summary information for the top 10 countries by the number of addresses being blocked). Interesting to note that the automation has blocked a huge swath of addresses from China. State-sponsored cyberattacks?<\/p>\n
\r\n% mcblockc getactive ssh_losers\r\n\r\n...\r\n\r\n Addresses covered per country:\r\n CN 102,263,808\r\n \/10 networks: 8 (33,554,432 addresses)\r\n \/11 networks: 17 (35,651,584 addresses)\r\n \/12 networks: 21 (22,020,096 addresses)\r\n \/13 networks: 11 (5,767,168 addresses)\r\n \/14 networks: 14 (3,670,016 addresses)\r\n \/15 networks: 9 (1,179,648 addresses)\r\n \/16 networks: 6 (393,216 addresses)\r\n \/18 networks: 1 (16,384 addresses)\r\n \/19 networks: 1 (8,192 addresses)\r\n \/21 networks: 1 (2,048 addresses)\r\n \/22 networks: 1 (1,024 addresses)\r\n KR 7,864,320\r\n \/10 networks: 1 (4,194,304 addresses)\r\n \/11 networks: 1 (2,097,152 addresses)\r\n \/12 networks: 1 (1,048,576 addresses)\r\n \/13 networks: 1 (524,288 addresses)\r\n IN 7,340,032\r\n \/10 networks: 1 (4,194,304 addresses)\r\n \/12 networks: 2 (2,097,152 addresses)\r\n \/13 networks: 1 (524,288 addresses)\r\n \/14 networks: 2 (524,288 addresses)\r\n BR 7,252,992\r\n \/11 networks: 3 (6,291,456 addresses)\r\n \/13 networks: 1 (524,288 addresses)\r\n \/14 networks: 1 (262,144 addresses)\r\n \/15 networks: 1 (131,072 addresses)\r\n \/17 networks: 1 (32,768 addresses)\r\n \/19 networks: 1 (8,192 addresses)\r\n \/21 networks: 1 (2,048 addresses)\r\n \/22 networks: 1 (1,024 addresses)\r\n FR 6,782,976\r\n \/10 networks: 1 (4,194,304 addresses)\r\n \/11 networks: 1 (2,097,152 addresses)\r\n \/15 networks: 1 (131,072 addresses)\r\n \/16 networks: 5 (327,680 addresses)\r\n \/18 networks: 2 (32,768 addresses)\r\n AR 4,524,032\r\n \/12 networks: 1 (1,048,576 addresses)\r\n \/13 networks: 2 (1,048,576 addresses)\r\n \/14 networks: 8 (2,097,152 addresses)\r\n \/15 networks: 2 (262,144 addresses)\r\n \/16 networks: 1 (65,536 addresses)\r\n \/21 networks: 1 (2,048 addresses)\r\n JP 4,227,072\r\n \/10 networks: 1 (4,194,304 addresses)\r\n \/17 networks: 1 (32,768 addresses)\r\n RU 3,484,672\r\n \/13 networks: 2 (1,048,576 addresses)\r\n \/14 networks: 5 (1,310,720 addresses)\r\n \/15 networks: 6 (786,432 addresses)\r\n \/16 networks: 2 (131,072 addresses)\r\n \/17 networks: 4 (131,072 addresses)\r\n \/18 networks: 2 (32,768 addresses)\r\n \/19 networks: 5 (40,960 addresses)\r\n \/22 networks: 3 (3,072 addresses)\r\n IT 3,280,896\r\n \/11 networks: 1 (2,097,152 addresses)\r\n \/12 networks: 1 (1,048,576 addresses)\r\n \/15 networks: 1 (131,072 addresses)\r\n \/20 networks: 1 (4,096 addresses)\r\n TW 2,637,824\r\n \/12 networks: 2 (2,097,152 addresses)\r\n \/13 networks: 1 (524,288 addresses)\r\n \/18 networks: 1 (16,384 addresses)\r\n\r\n...\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"The mcblockd automation has been running for roughly one week. It’s been fairly busy automatically blocking those trying to crack my ssh server. Below is some of the output from a query of the active blocked networks (the summary information for the top 10 countries by the number of addresses being blocked). Interesting to note … <\/p>\n