[nsp-sec] DFN-CERT#42614 - Distributed SSH Probes

[Rob Thomas]

Hey, Mike.

> Did anyone else notice their distributed ssh scans stop on the 19th at
> about 23:00 gmt ?

Here are hourly the TCP 22 counts from our Darknet pods.

Date and Time UTC   TCP 22 Scans
2009-04-19 19:00    1855
2009-04-19 20:00    1411
2009-04-19 21:00     573
2009-04-19 22:00    1396
2009-04-19 23:00    2746

By date:

Date UTC      TCP 22 Scans
2009-04-15    24038
2009-04-16    26784
2009-04-17    25542
2009-04-18    24418
2009-04-19    31891

The data from 2009-04-20 hasn't fully loaded yet.

Thanks,
Rob.
-- 
Rob Thomas
Team Cymru
http://www.team-cymru.org/
cmn_err(CEO_PANIC, "Out of coffee!");