Security Incidents mailing list archives

Re: Anyone else seeing SSH scans?


From: "Seth J. Blank" <sblank () vtsystems com>
Date: Wed, 28 Jul 2004 10:53:25 -0400


Yes, this is the third day in a row I've seen ssh scans for test and guest accounts across my IP block.

Seth

Matthew Dharm wrote:

I've noticed that several *NIX machines I have running (all of which are
located in the same IP block) are periodically getting scanned via ssh for
the accounts 'test' and 'guest'.

The source IP varies with each scan.  But I'm getting about one of these a
day now.  Obviously, I don't have accounts with that name on my systems,
but still....

Is this something new, or just people looking for badly configured
machines?

Matt


--

Best Regards,

Seth Blank
Director of Systems Operations
Visual Trading Systems, LLC



Current thread: