RE: Bestonsearch.com
"Terje Trane" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
Esler, Joel - Contractor wrote: > I've seen the NODEVssh action before. Usually this is a result of a > cron job running ssh as a client. So BestOnSearch is running a script that tries to connect to one of my servers? Hmmmm... /var/log/secure: Aug 30 10:40:33 webserver sshd[22345]: Failed password for illegal user guest from 65.75.181.100 port 56595 ssh2 Aug 30 10:40:37 webserver sshd[22347]: Failed password for admin from 65.75.181.100 port 56798 ssh2 Aug 30 10:40:41 webserver sshd[22349]: Failed password for admin from 65.75.181.100 port 56927 ssh2 Aug 30 10:40:42 webserver sshd[22351]: Illegal user user from 65.75.181.100 Aug 30 10:40:45 webserver sshd[22351]: Failed password for illegal user user from 65.75.181.100 port 57183 ssh2 Aug 30 10:40:49 webserver sshd[22353]: Failed password for root from 65.75.181.100 port 57420 ssh2 Aug 30 10:40:53 webserver sshd[22355]: Failed password for root from 65.75.181.100 port 57624 ssh2 Aug 30 10:40:57 webserver sshd[22357]: Failed password for root from 65.75.181.100 port 57793 ssh2 Aug 30 10:40:59 webserver sshd[22359]: Illegal user test from 65.75.181.100 Aug 30 10:41:01 webserver sshd[22359]: Failed password for illegal user test from 65.75.181.100 port 57950 ssh2 Intrusions List (GCIA Practicals) _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions