[nsp-sec] slow distributed ssh scan

[Rob Thomas]

Hey, Mike.

> I will submit to the scanner list for the next few days, but these
> guys started to show up again just recently. Seems to be coordinated
> as the user ids are sequential and the time gap is stretched out per
> host to try and get in under the radar.

Aces, thanks for that!

88.191.89.25 has been at it since at least 2011-08-15 00:58:55 UTC.
You're not kidding - it's a busy host!  It appears to be an Ubuntu box.

Thanks,
Rob.
-- 
Rob Thomas
Team Cymru
https://www.team-cymru.org/
"Say little and do much." M Avot 1:15