TSUBAME Report Overflow (Oct-Dec 2022)

This TSUBAME Report Overflow series discuss monitoring trends of overseas TSUBAME sensors and other activities which the Internet Threat Monitoring Quarterly Reports does not include. This article covers the monitoring results for the period of October to December 2022. The scan trends observed with TSUBAME sensors in Japan are presented in graphs here.

Changes in Mirai-type packets in Japan (Top 5 source regions)

Figure 1 shows a daily graph of the top 5 IP addresses by source region for packets with Mirai-type characteristics observed by TSUBAME, and Figure 2 shows a daily graph of the total number and that of the top 5 combined.

Figure 1: Number of Mirai-type hosts for each source region Figure 2: Total number of Mirai-type hosts and that of the top 5 combined

Comparison of the observation trends in Japan and overseas

Figures 3 and 4 show a monthly comparison of the average number of packets received per day by each sensor in Japan and overseas. More packets were observed by overseas sensors than those in Japan.

Figure 3: Average number of packets to domestic sensors Figure 4: Average number of packets to overseas sensors

Comparison of monitoring trends by sensor

A global IP address is assigned to each TSUBAME sensor. Table 2 shows the top 10 ports of each sensor which received packets the most. The top 6 ports are the same in every sensor in Japan, while they were different from overseas sensors. Many sensors observe the packets for 23/TCP the most, and 6379/TCP is also in the top 10 on many sensors. This suggests that these protocols are being scanned in a wide range of networks.

Table 1: Comparison of top 10 packets by domestic and overseas sensors

  #1 #2 #3 #4 #5 #6 #7 #8 #9 #10
Domestic sensor 1 23/TCP 6379/TCP 80/TCP 22/TCP 445/TCP 443/TCP 81/TCP 8088/TCP 8080/TCP 5555/TCP
Domestic sensor 2 23/TCP 6379/TCP 80/TCP 22/TCP 445/TCP 443/TCP 5555/TCP 81/TCP 8080/TCP 1433/TCP
Domestic sensor 3 23/TCP 6379/TCP 80/TCP 22/TCP 445/TCP 443/TCP 5555/TCP 81/TCP 8080/TCP 1433/TCP
Overseas sensor 1 6379/TCP 80/TCP ICMP 5555/TCP 443/TCP 81/TCP 2375/TCP 5060/UDP 2323/TCP 2376/TCP
Overseas sensor 2 23/TCP 6379/TCP ICMP 80/TCP 22/TCP 5555/TCP 443/TCP 5060/UDP 1433/TCP 8080/TCP
Overseas sensor 3 23/TCP 6379/TCP 22/TCP 5555/TCP 3389/TCP 80/TCP ICMP 443/TCP 81/TCP 1433/TCP

In Closing

Monitoring at multiple points makes it possible to see whether some trends are unique to a particular network. Although we have not published any special alerts as an extra issue or other information this quarter, it is important to pay attention to scanners. We will continue to publish blog articles as the Internet Threat Monitoring Quarterly Report becomes available every quarter. We will also publish an extra issue when we observe any unusual change. Your feedback on this series is much appreciated. Please use the below comment form to let us know which topic you would like us to introduce or discuss further. Thank you for reading.

Keisuke Shikano (Translated by Takumi Nakano)