Re: Anyone else seeing a spike in SSHd scans?

[Dave Laird <dlaird () kharma net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Good afternoon, Jay, everyone...

On Friday 27 June 2003 12:55 pm, Jay D. Dyson wrote:
> Hi folks,
>
>       I've seen an unusual spike in SSHd scans in the past 20 hours on
> systems I maintain for my employer and those I run on my own time.  The
> largest spike began yesterday between 12:16 and 18:16 hours (PDT) and the
> others have begun trickling in on my non-work networks since around 08:00
> hours today.

>       It's all the usual suspects, of course: systems from Malaysia, the
> Netherlands, a DSL provider in Norway, and a Cable service in Taiwan.

Since I block some/most of those locations in my firewall, I was a bit
surprised when I noted a spike in SSH scans yesterday, between 14:22 and
18:05 PDT. Then they started up again this afternoon, from what appears to
be both attbi.com and comcast DSL IP's. Hmmm. Maybe your're right. 

Dave
- -- 
Dave Laird (Dave () kharma net)
The Used Kharma Lot / The Phoenix Project 
Web Page:   http://www.kharma.net updated 04/15/2003
Usenet News server: news.kharma.net
Musicians Calendar and Database access: http://www.kharma.net/calendar.html
                                           
An automatic & random thought For the Minute:    
Freedom from incrustation of grime is contiguous to rectitude.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+/hE/Zx0/eWCCG/wRAiQ7AJ9EXccwJtu4qaUh1Izt1oOvcq9qEQCfeeel
6aBS2PohGOisIFeHX2n710o=
=EPq2
-----END PGP SIGNATURE-----


----------------------------------------------------------------------------
Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the
world's premier technical IT security event! 10 tracks, 15 training sessions,
1,800 delegates from 30 nations including all of the top experts, from CSO's to
"underground" security specialists.  See for yourself what the buzz is about!
Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
----------------------------------------------------------------------------