Security Incidents mailing list archives

Re: Automated SSH scanning


From: Sean Dalnodar <sdalnodar () COMSTAR NET>
Date: Tue, 25 Jul 2000 10:14:00 -0400

University of Alberta (NET-U-ALBERTA)
   Computing & Network Services
   Rm 352 General Services Building
   University of Alberta
   Edmonton, Alberta; T6G 2H1
   CANADA

   Netname: U-ALBERTA
   Netnumber: 129.128.0.0

   Coordinator:
      Watts, Kevin  (KW1848-ARIN)  kevin.watts () UALBERTA CA
      403-492-9583 (FAX) 403-492-1759

   Domain System inverse mapping provided by:

   NAME.UALBERTA.CA             129.128.5.233
   NOM.UALBERTA.CA              129.128.76.233
   MENAIK.CS.UALBERTA.CA        129.128.4.241

I really dont like uninvited probes from untrusted networks. I will choose the
filter option heeh.

On 25-Jul-2000 John Kristoff wrote:
Saw some SSH probes today, which frightened me somewhat.  It turns out
to be survey profiling device.  This machine (the source of the probes),
offer's some brief details:

http://ssh-research-scanner.ucs.ualberta.ca/

Although it would be nice if *they* filtered the netblocks people didn't
want scanned rather than placing the burden on the sites they are
scanning.

John

----------------------------------
Sean M Dalnodar
Comstar.net Inc
Security Department
sdalnodar () comstar net
(770)485-6037
Date: 25-Jul-2000
Time: 10:12:19

"Monopoly? I thought that was a board game!!" - Bill
----------------------------------


Current thread: