[nsp-sec] Contact at AS18209 - 123.176.40.122

[Joel Rosenblatt]

Hi,

If someone has a contact at AS18209, can they please pass this along to them - we have been hit by this machine for the last 3 days in increasing numbers.

123.176.40.122 22/tcp 2011-01-27 02:45:00 GMT-0500 2011-01-28 01:50:00 GMT-0500 24091145

Thanks,
Joel

Logged attempts below - above is total attempts against all machines on our network.

Address:  123.176.40.122

First attempt: Jan 27 04:05:03 GMT -0500
Last attempt: Jan 27 23:59:58 GMT -0500
Total attempts: 2231507

All logs are GMT -0500.

Jan 27 04:05:03 akee sshd[5963]: [ID 800047 daemon.info] Failed password for invalid user ftpuser from 123.176.40.122 port 60297 ssh2
Jan 27 04:05:05 akee sshd[6009]: [ID 800047 daemon.info] Failed password for invalid user username from 123.176.40.122 port 60975 ssh2
Jan 27 04:05:07 akee sshd[6011]: [ID 800047 daemon.info] Failed password for invalid user administrator from 123.176.40.122 port 61749 ssh2
Jan 27 04:05:09 akee sshd[6014]: [ID 800047 daemon.info] Failed password for invalid user library from 123.176.40.122 port 62430 ssh2
Jan 27 04:05:12 akee sshd[6017]: [ID 800047 daemon.info] Failed password for invalid user test from 123.176.40.122 port 63170 ssh2
Jan 27 04:05:14 akee sshd[6018]: [ID 800047 daemon.info] Failed password for invalid user guest from 123.176.40.122 port 63930 ssh2
Jan 27 04:05:17 akee sshd[6019]: [ID 800047 daemon.info] Failed password for invalid user master from 123.176.40.122 port 64662 ssh2

....

Joel Rosenblatt, Manager Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel
Public PGP key
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x90BD740BCC7326C3