Re: Uptick in SSH scanning ?

[Laurie Zirkle <lat () VT EDU>]

I have not gotten a count, but I know I've seen a lot more unique
addresses and an uptick.  Not as many huge brute force, more like
spoofed and trying to stay under the radar by not tripping Fail2Ban or
our iptables rate limits.

--
Laurie


On Thu, Dec 11, 2014 at 7:35 PM, Jason Gates <jasongates () southern edu> wrote:
> Two /20 subnets here..
> Today: 1135 unique addresses
> Yesterday: 1328
> 3 days ago: 1638
> 4 days ago: 400
> 5 days ago: 121
> 6 days and beyond: ~100
>
> source ip address list attached..
>
>
> -----Original Message-----
> From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Andrew 
> Daviel
> Sent: Thursday, December 11, 2014 6:44 PM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: [SECURITY] Uptick in SSH scanning ?
>
> We seem to have seen a 10x increase in SSH scans over the last few days.
> I wondered if that was a common experience.
> From something like 40 unique source addresses/day to a /16 subnet to over
> 1000 yesterday.
>
>
> --
> Andrew Daviel, TRIUMF, Canada
> Tel. +1 (604) 222-7376  (Pacific Time)
> Network Security Manager