Re: SSH scanning.

elboricua
El Subestimado
Premium
join:2001-08-12
Bronx, NY

Most of the IP's that have been scanning me are from Quebec and from the UK. In my case the usernames being tried are admin and user. With some root thrown in for good measure.

Some snippits from my logs.

Jul 19 14:42:02 Vulcan-Raven sshd[3959]: Illegal user admin from 213.86.59.248
Jul 19 14:42:02 Vulcan-Raven sshd[20578]: input_userauth_request: illegal user a
dmin
Jul 19 14:42:02 Vulcan-Raven sshd[20578]: Failed password for illegal user admin
 from 213.86.59.248 port 40497 ssh2
Jul 19 14:42:02 Vulcan-Raven sshd[20578]: Received disconnect from 213.86.59.248
: 11: Bye Bye
Jul 19 14:42:03 Vulcan-Raven sshd[6934]: Illegal user guest from 213.86.59.248
Jul 19 14:42:03 Vulcan-Raven sshd[30903]: input_userauth_request: illegal user g
uest
Jul 19 14:42:03 Vulcan-Raven sshd[30903]: Failed password for illegal user guest
 from 213.86.59.248 port 40525 ssh2
Jul 19 14:42:03 Vulcan-Raven sshd[30903]: Received disconnect from 213.86.59.248
: 11: Bye Bye
Jul 19 14:42:03 Vulcan-Raven sshd[32021]: Illegal user admin from 213.86.59.248
Jul 19 14:42:03 Vulcan-Raven sshd[9129]: input_userauth_request: illegal user ad
min
Jul 19 14:42:03 Vulcan-Raven sshd[9129]: Failed password for illegal user admin
from 213.86.59.248 port 40539 ssh2
Jul 19 14:42:04 Vulcan-Raven sshd[9129]: Received disconnect from 213.86.59.248:
 11: Bye Bye
Jul 19 14:42:04 Vulcan-Raven sshd[31823]: Illegal user admin from 213.86.59.248
Jul 19 14:42:04 Vulcan-Raven sshd[24870]: input_userauth_request: illegal user a
dmin

EDIT:

Added loginfo

permalink · 2004-07-23 11:37:16 · Print ·


Thursday, 26-Nov 21:38:08	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 10 years online! © 1999-2009 dslreports.com. page compression OFF