09/17/2026
An advisory for anyone running a server at a cloud provider.
We measured a week of SSH attacks on two production machines. The number that should concern you is not the volume. It is the origin.
84.6% of the attributable traffic came from datacenter IPs, not home internet connections. Those are rented servers, and a meaningful share of them are compromised production machines whose owners have no idea they spend all day attacking strangers.
Everyone worries about being broken into. Almost nobody checks whether their machine is already being used against someone else, and the tells are quiet: load high while the application serves almost nothing, outbound bandwidth that does not match the visitor count, processes running out of /tmp, cron jobs or SSH keys nobody wrote.
It is not anonymous either. Every attempt your server sends lands in a stranger's log with your IP beside it. We traced the largest cluster in our data to a named company using public registry records alone.
Turn off SSH password authentication. Keys only. Verify with sshd -T that the file you edited is the config in effect. Across 121,222 attempts in a week, not one password login succeeded, because there was no password to guess.
https://appluex.com/insights/anatomy-of-an-ssh-botnet
Two clients called about servers that kept needing a reboot. We measured both and found 121,222 and 22,479 failed SSH logins, from 925 and 1,830 addresses, at almost identical daily rates. The full measurement: who they were, what the traffic was costing the machines, how we traced the biggest clust...
