Is this IP attacking my server?

Like many others, I maintain a server that runs 24/7 and it’s connected to the internet. Yesterday I came home to a most unusual sight on my server’s status LEDs – unexplained network activity. It’s unusual because for me, my server is almost always idle. It doesn’t serve web pages, and in fact it doesn’t really do much for the internet except for accepting SSH connections so I can access my home resources while away. So I thought I might want to investigate the cause of the suspicious network activity.

It was a good thing that username and password authentication have been disabled. My investigations after the break!

Read more »