pmohr
Premium
join:2002-09-22
Oak Ridge, TN
| reply to BeesTea
Re: SSH scanning.
Hmm, only a few attempts here -
Jul 22 01:47:46 hackzbox sshd[4477]: Failed password for illegal user test from 24.14.31.1
*45 port 3565 ssh2
Jul 22 01:47:47 hackzbox sshd[4479]: Failed password for illegal user guest from 24.14.31.
*145 port 3621 ssh2
Jul 18 03:45:38 hackzbox sshd[25647]: Failed password for illegal user test from 62.117.99
*.83 port 3841 ssh2
Jul 18 03:45:39 hackzbox sshd[25649]: Failed password for illegal user guest from 62.117.9
*9.83 port 3870 ssh2
(*) WARNING 4 long line(s) split
However, I've had a lot more scans on my ftp, which I guess could be normal, but since I rarely check my auth logs, not really something I've seen -
[ Fri Jul 23 - 16:02:22 - pts/21 ]
[pmohr@HackzBox] log $ sudo grep no\ such\ user auth.log | wc -l
16
[ Fri Jul 23 - 16:02:24 - pts/21 ]
[pmohr@HackzBox] log $ sudo bzcat auth.log.*.bz* | grep no\ such\ user | wc -l
16
|
|
JohnInSJ
Premium
join:2003-09-22
San Jose, CA
 ·Comcast
| Weird. I got a 4 more today, from 194.105.226.117 (skjalfti17.simnet.is)- same test/guest ssh probe. Something must be worming its way around the net.
Iceland? (simnet.is) O...K...  |
|
JohnInSJ
Premium
join:2003-09-22
San Jose, CA
·Comcast
| Oh hey guys you might want to drop the SANS Internet Storm Center folks a message - they're tracking this to see how big it is.
»isc.incidents.org/diary.php?isc=···a345f342 |
|
