[nsp-sec] as 6453 38550 ssh bruteforce from a /24 block?

Smith, Donald Donald.Smith at qwest.com
Fri Feb 29 00:36:27 EST 2008


104 unique ips were seen attempting a distributed coordinated ssh bruteforce attempt from this netblock 
58.147.10.0/24.
This was reported at 19:34 MDT today.
Here is a small sample of the username attempts.
[<address> <# of probes> @ <age from now in hours> ]

[58.147.10.121 1 @ 3.31] [58.147.10.143 2 @ 3.31] [58.147.10.242 2 @ 3.31]
 
I can provide the complete list of ips if desired:)
 
donald.smith at qwest.com giac


This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly 
prohibited and may be unlawful.  If you have received this communication 
in error, please immediately notify the sender by reply e-mail and destroy 
all copies of the communication and any attachments.



More information about the nsp-security mailing list