583 servers scanned SSH for 28 hours. Nine in ten are mail servers, two thirds run a dead OS.
https://honeylabs.net/blog/ssh-sweep-one-address-per-network
Published: September 19, 2026 11:15
Small organisations' mail servers, Postfix on CentOS 7 for the most part, spent 3 and 4 September scanning the internet for SSH. 583 hosts, 391 networks, one client fingerprint. What the scanner collects, who the machines are, why they were picked, and…