import csv
import time
from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.common.keys import Keys
from selenium.webdriver.chrome.options import Options

options = Options()
options.add_argument('--ignore-certificate-errors')
options.add_argument('--ignore-ssl-errors')
options.add_experimental_option('excludeSwitches', ['enable-logging'])

#open the target data csv file for recording IP details
f = open('sshAttemptData.csv', 'w', encoding='UTF8', newline='')
writer = csv.writer(f)
browser=webdriver.Chrome(chrome_options=options)

#open and iterate through the source data csv file
with open('top100IPs.csv', newline='') as csvfile:
	csvreader = csv.reader(csvfile, delimiter=' ', quotechar='|')
	rows = list(csvreader)
	count = 1
	for row in rows:
		url = 'https://whatismyipaddress.com/ip/' + row[0]
		#navigate to the url for the specified IP
		browser.get(url)
		time.sleep(1)
		#collect relevant data about the IP
		elements = browser.find_elements(By.CLASS_NAME, "information")
		datarow = []
		for i in elements:
			st = i.text
			data = (st.split(':')[1]).lstrip()
			datarow.append(data)
		print("Site num: " + str(count))
		for item in datarow:
			print(item)
		#write IP data to output csv
		count = count + 1
		writer.writerow(datarow)
#close the target data csv file for recording IP details
f.close()

Top 100 IP Addresses By Authentication Attempts

Conclusion

The observed attempts to gain access to the publicly facing compute instance where not particularly advanced. However, due to the distributed attacks coming from many IPs within a particular range, this suggests that a signifigant amount of infrastructure may have been dedicated to perform exclusively these activities.

To further research the nature of the attempts to gain access to the compute instance, a true SSH Honeypot may be used to identify common passwords attempted. Additionally, if the SSH Daemon is configured to run in a secure and containerized envrionment, it may be possible allow the malicious machines to gain pseudo-control of the honeypot server to better understand the intent of the malicious IPs.