Re: Voluminous SSHd scanning; possible worm activity?

From: Russell Fulton (r.fultonat_private)
Date: Mon Dec 10 2001 - 13:13:47 PST

Next message: Florian Weimer: "Re: Voluminous SSHd scanning; possible worm activity?"

Previous message: Markus Friedl: "Re: Voluminous SSHd scanning; possible worm activity?"
In reply to: Jay D. Dyson: "Voluminous SSHd scanning; possible worm activity?"
Next in thread: Jacek Lipkowski: "Re: Voluminous SSHd scanning; possible worm activity?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Sun, 9 Dec 2001 12:23:26 -0800 (PST) "Jay D. Dyson" 
<jdysonat_private> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> Hi folks,
> 
> 	I've been seeing a lot of SSHd scans of late.  That in itself
> isn't odd, but the sheer volume of the scans is what's got my attention. 
> These sorts of scans used to occur infrequently, but now they're coming
> within minutes of each other, and they're coming from all over the globe. 
> 
> 	Has anyone else seen this sort of thing from their systems?

I'm seeing four or five scans a day across two disparate network 
blocks. (i.e. *total* of four or five).


Russell Fulton, Computer and Network Security Officer
The University of Auckland,  New Zealand


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Florian Weimer: "Re: Voluminous SSHd scanning; possible worm activity?"
Previous message: Markus Friedl: "Re: Voluminous SSHd scanning; possible worm activity?"
In reply to: Jay D. Dyson: "Voluminous SSHd scanning; possible worm activity?"
Next in thread: Jacek Lipkowski: "Re: Voluminous SSHd scanning; possible worm activity?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Dec 10 2001 - 15:45:30 PST