TSUBAME Report Overflow (Jan-Mar 2023)

JPCERT/CC’s TSUBAME report (Jan–Mar 2023) highlights a spike in SSH (22/TCP) and VNC (5900/TCP) scanning traced to IPs at a Japanese hosting provider, validated via TTL comparisons across global sensors to suggest non-spoofed, Japan-origin traffic; activity clustered on weekends and month-ends. Overseas sensors observed higher packet volumes overall, and common targeted ports across sensors included 23/TCP, 6379/TCP, 22/TCP, 80/TCP, 445/TCP, and 3389/TCP; no special alerts were issued, but continued monitoring of scanners is advised.