Bruteforce techniques are indeed evolving.

Before I switched my sshd ports a few weeks ago, I often saw break in attempts on my servers that would imply checking only a single username and a single password.

My guess on that is that bruteforcers, rather than testing thousands of usernames with thousand of passwords on a single host will try a single username and single password on thousands of hosts.

yes, this have been going on for a while

http://bsdly.blogspot.no/2013/10/the-hail-mary-cloud-and-les...

Very interesting article, thanks.

I double checked my log archives, it seems not to be exactly the same, though. In what is reported here, a same username will be tried with several password, allowing something like a minute to pass to make a new attempt.

In my logs, this is really just a single attempt. Other break in attempt may happen something like two days after, but with an other IP and username.

It may just be yet an other evolution of the same botnet knowing its previous pattern has been spotted, though.

(and in case you wonder, yes, I always have the nose in my logs, having a dedicated monitor for that :) )

How does IPV6 affect things?

As with IPv4, DoS attacks which tend to be clustered from specific locations (I've seen them originating from multiple hosts within a hosting center's range, or from a particularly poorly managed ISP's allocation), using broader allocations (CIDR blocks and ASNs) to identify responsible networks can be useful. The challenge in general is translating from IP addresses to the administrative block responsible (there are IP reverse lookups which do this, in some cases the zonefiles are downloadable allowing lookups at local network speeds), and in translating the information to some sort of policy (few network management devices offer AS blocking rules, though CIDR is pretty much native).

It is probable that a single machine gets a /64 ipv6 range, but the first 64 bits are consistent. When ipv6 gets more common it will probably be more acceptable to block an entire /64 if you suspect a brute force attack.