Security Incidents mailing list archives
Re: SSH attacks?
From: Skip Carter <skip () taygeta com>
Date: Thu, 29 Jul 2004 16:13:13 -0700
Our block got hit by two in your list on July 24... 61.117.135.98 real.mv.hamers.co.jp 211.184.226.193 korea - pubnet address space Looks like Linux boxen...anyone else check others?
None of the others in the list hit us or or clients. But ONE of our clients got probed by this one last night: 38.144.33.95 (none of our other clients have seen anything like this (yet?) ) It looks like a compromised Linux web server to me. Skip -- Dr. Everett (Skip) Carter Phone: 831-641-0645 FAX: 831-641-0647 Taygeta Scientific Inc. INTERNET: skip () taygeta com 1340 Munras Ave., Suite 314 WWW: http://www.taygeta.com Monterey, CA. 93940
Attachment:
_bin
Description:
Current thread:
- Re: SSH attacks?, (continued)
- Re: SSH attacks? Marcus Merrin (Jul 29)
- Re: SSH attacks? Robin (Jul 30)
- RE: SSH attacks? Herman Frederick Ebeling Jr. (Jul 30)
- Re: SSH attacks? Brian C. Lane (Jul 30)
- Re: SSH attacks? Mike Whitley (Jul 29)
- Re: SSH attacks? David Block (Jul 29)
- Re: SSH attacks? Bulgaro (Jul 29)
- Re: SSH attacks? John Bossert (Jul 30)
- RE: SSH attacks? M Shirk (Jul 30)
- Re: SSH attacks? Valdis . Kletnieks (Jul 31)
- Re: SSH attacks? Skip Carter (Jul 30)
- Re: SSH attacks? Alexander Klimov (Jul 31)