Scans for SSHd via RIPE netblocks, anyone?

From: Jay D. Dyson (jdysonat_private)
Date: Sun Oct 21 2001 - 01:06:27 PDT

  • Next message: Emre Yildirim: "suspicious http log"

    -----BEGIN PGP SIGNED MESSAGE-----
    
    Hi folks,
    
    	No great shakes here, but I'm curious to know if anyone else is
    seeing concerted SSHd scans coming from RIPE netblocks lately.  I've noted
    a few here and, while I considered them oddities at first, I'm starting to
    wonder if someone (or something) across the Atlantic doesn't have the
    much-ballyhoo'd "0day for sale."
    
    	I'm not bored enough to see what they're really up to (yet), so I
    figured I'd just toss this out for general consideration.
    
    	Oh yeah, the latest scan came from 193.206.153.7.
    
    - -Jay
    
      (    (                                                         _______
      ))   ))   .-"There's always time for a good cup of coffee."-.   >====<--.
    C|~~|C|~~| (>------ Jay D. Dyson - jdysonat_private ------<) |    = |-'
     `--' `--'  `- Peace without justice is life without living. -'  `------'
    
    -----BEGIN PGP SIGNATURE-----
    Version: 2.6.2
    Comment: See http://www.treachery.net/~jdyson/ for current keys.
    
    iQCVAwUBO9Jz97lDRyqRQ2a9AQHKbwP9EJcPFxXXWuPtOYRVYZmsIEPiomtwXDfu
    xKTD01KsWH/dXGxs/h4kKd/QRzPGHnHreri59Sd9UBua+EV0VjzCzcR44Ne9k5ns
    3FnP3TYrS1nVJ4q5cm4cawWNXRx3zo0loCbiYRT6Mbsp99y/Rju6Dy2OzA3VaYkH
    kKz41A1aFKc=
    =kGQe
    -----END PGP SIGNATURE-----
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Mon Oct 22 2001 - 08:31:11 PDT