Re: SSH attacks?

[buzz <reitenba () fh-brandenburg de>]

On Tuesday 27 July 2004 00:59, Robin wrote:

> Looking a bit closer (and in other log files), I see it's people trying
> random accounts. The big ones are going over a large list, the pairs seem
> to be just hitting test and guest:
> Jul 26 23:05:59 kallisti sshd[12314]: Illegal user test
> from ::ffff:64.246.56.44
> Jul 26 23:05:59 kallisti sshd[12314]: Failed password for illegal user test
> from ::ffff:64.246.56.44 port 41920 ssh2
> Jul 26 23:06:01 kallisti sshd[12320]: Illegal user guest
> from ::ffff:64.246.56.44
> Jul 26 23:06:01 kallisti sshd[12320]: Failed password for illegal user
> guest from ::ffff:64.246.56.44 port 41967 ssh2
>
> Does anyone know why this would appear all of a sudden?

there is a thread on full-disclosure covering these ssh login attempts.

someone gave a link to the following site:
http://www.dslreports.com/forum/remark,10854834~mode=flat~days=9999

buzz