RE: sshd bruteforce from 66.246.72.184

Got a copy of CRM2?
I would like to add it to my collection of ssh bruteforcers.


[email protected] giac




-----Original Message-----
From: [email protected] on behalf of Ryan Pavely
Sent: Mon 2/21/2005 8:47 PM
To: Ryan Pavely
Cc: [email protected]; Intrusions List (GCIA Practicals)
Subject: Re: [Intrusions] sshd bruteforce from 66.246.72.184
 
The IP address in question was a 15minuteserver purchased used fished 
paypal info and credit card info.  After your reported ssh brute force 
attempts we were able to determine it was indeed fraud and have canceled 
the customer.

I apologize for the nasty traffic it seems our new product creates as 
everyone now knows they can get a server FAST through us.  This brings 
out the worst of the crowd.  We have instituted a network monitoring 
system and are currently configuring it to be able to automatically 
detect outgoing mass-remote-host ssh connections.. socks/proxy 
connections.. smtp connections.. the works.. Via an automated system 
these customers will be locked out pending a TOS/AUP review.

I see no reason why you shouldn't continue to block these ip's unless 
you wish to access games / websites / etc clients host.


Ps.  The latest SSH coordinated attack was from a group in Germany that 
is using some program called CRM2.  They did this from about 10 
different machines purchased over the last few weeks, but those are ALL 
disabled now.  I can forward details of the program if anyone so desires.

 Ryan Pavely
  Director Research And Development
  Net Access Corporation
  http://www.nac.net/ http://www.15minuteservers.com/

  Ryan Pavely
   Director Research And Development
   Net Access Corporation
   http://www.nac.net/ http://www.15minuteservers.com/


> Chuck Haines wrote:
>
> We've seen the exact same brute force attempts on our machines here in
> the WPI ECE Dept.  After we got two sets of brute force attemps from
> this IP and a few others with the same attack we've blacklisted them
> on our firewall.
>
> Chuck Haines
> ECE Systems Administrator
>
> On Sun, 20 Feb 2005 11:42:38 -0600, kenneth gf brown 
> <[email protected]> wrote:
>  
>
>> we have experienced co-ordinatded bruteforce ssh attempts
>> to access our servers
>>
>> all packets from the offending IP have been blocked at our firewalls
>> and will no longer be able to access any services
>> provided by our organization
>>
>> Attack time 0734 - 0854 CST
>>
>> this attack is considered a targeted attempt on our servers.
>>
>> either the individual attempted to individually attack
>>
>> 205.200.75.113
>> 205.200.160.150
>> 205.200.160.250
>>
>> OR the individual attacked
>>
>> 205.200.75.113 on unpublished ports that redirect
>> ssh to the target machines
>>
>> kenneth gf brown
>> ceo shadowplay.net
>>
>> logs follow all times are CST
>>
>> attack on server ip 205.200.160.150
>>
>> Feb 19 07:34:52 eclipse sshd[11944]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 07:34:54 eclipse sshd[11944]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 52762 ssh2
>> Feb 19 07:34:55 eclipse sshd[11947]: Illegal user guest from 
>> 66.246.72.184
>> Feb 19 07:34:57 eclipse sshd[11947]: Failed password for illegal user 
>> guest
>> from 66.246.72.184 port 53177 ssh2
>> Feb 19 07:35:00 eclipse sshd[11949]: Failed password for admin from
>> 66.246.72.184 port 53504 ssh2
>> Feb 19 07:35:04 eclipse sshd[11967]: Failed password for admin from
>> 66.246.72.184 port 53897 ssh2
>> Feb 19 07:35:04 eclipse sshd[11983]: Illegal user user from 
>> 66.246.72.184
>> Feb 19 07:35:07 eclipse sshd[11983]: Failed password for illegal user 
>> user
>> from 66.246.72.184 port 54379 ssh2
>> Feb 19 07:35:10 eclipse sshd[11985]: Failed password for root from
>> 66.246.72.184 port 54871 ssh2
>> Feb 19 07:35:13 eclipse sshd[11993]: Failed password for root from
>> 66.246.72.184 port 55441 ssh2
>> Feb 19 07:35:16 eclipse sshd[12001]: Failed password for root from
>> 66.246.72.184 port 55897 ssh2
>> Feb 19 07:35:16 eclipse sshd[12004]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 07:35:19 eclipse sshd[12004]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 56416 ssh2
>> Feb 19 07:43:43 eclipse sshd[12110]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 07:43:46 eclipse sshd[12110]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 44594 ssh2
>> Feb 19 07:43:46 eclipse sshd[12112]: Illegal user guest from 
>> 66.246.72.184
>> Feb 19 07:43:49 eclipse sshd[12112]: Failed password for illegal user 
>> guest
>> from 66.246.72.184 port 44883 ssh2
>> Feb 19 07:43:52 eclipse sshd[12114]: Failed password for admin from
>> 66.246.72.184 port 45192 ssh2
>> Feb 19 07:43:55 eclipse sshd[12116]: Failed password for admin from
>> 66.246.72.184 port 45491 ssh2
>> Feb 19 07:43:56 eclipse sshd[12118]: Illegal user user from 
>> 66.246.72.184
>> Feb 19 07:43:58 eclipse sshd[12118]: Failed password for illegal user 
>> user
>> from 66.246.72.184 port 45816 ssh2
>> Feb 19 07:44:01 eclipse sshd[12120]: Failed password for root from
>> 66.246.72.184 port 46157 ssh2
>> Feb 19 07:44:04 eclipse sshd[12127]: Failed password for root from
>> 66.246.72.184 port 46608 ssh2
>> Feb 19 07:44:07 eclipse sshd[12130]: Failed password for root from
>> 66.246.72.184 port 47046 ssh2
>> Feb 19 07:44:08 eclipse sshd[12132]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 07:44:10 eclipse sshd[12132]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 47503 ssh2
>> Feb 19 07:59:07 eclipse sshd[12389]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 07:59:10 eclipse sshd[12389]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 42720 ssh2
>> Feb 19 07:59:10 eclipse sshd[12391]: Illegal user guest from 
>> 66.246.72.184
>> Feb 19 07:59:13 eclipse sshd[12391]: Failed password for illegal user 
>> guest
>> from 66.246.72.184 port 42989 ssh2
>> Feb 19 07:59:16 eclipse sshd[12393]: Failed password for admin from
>> 66.246.72.184 port 43299 ssh2
>> Feb 19 07:59:19 eclipse sshd[12395]: Failed password for admin from
>> 66.246.72.184 port 43613 ssh2
>> Feb 19 07:59:20 eclipse sshd[12397]: Illegal user user from 
>> 66.246.72.184
>> Feb 19 07:59:22 eclipse sshd[12397]: Failed password for illegal user 
>> user
>> from 66.246.72.184 port 44103 ssh2
>> Feb 19 07:59:25 eclipse sshd[12399]: Failed password for root from
>> 66.246.72.184 port 44599 ssh2
>> Feb 19 07:59:28 eclipse sshd[12401]: Failed password for root from
>> 66.246.72.184 port 45093 ssh2
>> Feb 19 07:59:31 eclipse sshd[12403]: Failed password for root from
>> 66.246.72.184 port 45507 ssh2
>> Feb 19 07:59:32 eclipse sshd[12405]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 07:59:34 eclipse sshd[12405]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 45906 ssh2
>> Feb 19 08:19:25 eclipse sshd[12716]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 08:19:27 eclipse sshd[12716]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 34303 ssh2
>> Feb 19 08:19:28 eclipse sshd[12718]: Illegal user guest from 
>> 66.246.72.184
>> Feb 19 08:19:30 eclipse sshd[12718]: Failed password for illegal user 
>> guest
>> from 66.246.72.184 port 34607 ssh2
>> Feb 19 08:19:34 eclipse sshd[12720]: Failed password for admin from
>> 66.246.72.184 port 34891 ssh2
>> Feb 19 08:19:37 eclipse sshd[12722]: Failed password for admin from
>> 66.246.72.184 port 35176 ssh2
>> Feb 19 08:19:37 eclipse sshd[12725]: Illegal user user from 
>> 66.246.72.184
>> Feb 19 08:19:40 eclipse sshd[12725]: Failed password for illegal user 
>> user
>> from 66.246.72.184 port 35468 ssh2
>> Feb 19 08:19:43 eclipse sshd[12727]: Failed password for root from
>> 66.246.72.184 port 35757 ssh2
>> Feb 19 08:19:46 eclipse sshd[12730]: Failed password for root from
>> 66.246.72.184 port 36077 ssh2
>> Feb 19 08:19:49 eclipse sshd[12732]: Failed password for root from
>> 66.246.72.184 port 36368 ssh2
>> Feb 19 08:19:49 eclipse sshd[12734]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 08:19:52 eclipse sshd[12734]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 36736 ssh2
>> Feb 19 08:30:21 eclipse sshd[12941]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 08:30:23 eclipse sshd[12941]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 43010 ssh2
>> Feb 19 08:30:24 eclipse sshd[12943]: Illegal user guest from 
>> 66.246.72.184
>> Feb 19 08:30:26 eclipse sshd[12943]: Failed password for illegal user 
>> guest
>> from 66.246.72.184 port 43338 ssh2
>> Feb 19 08:30:29 eclipse sshd[12945]: Failed password for admin from
>> 66.246.72.184 port 43649 ssh2
>> Feb 19 08:30:32 eclipse sshd[12949]: Failed password for admin from
>> 66.246.72.184 port 43937 ssh2
>> Feb 19 08:30:33 eclipse sshd[12951]: Illegal user user from 
>> 66.246.72.184
>> Feb 19 08:30:35 eclipse sshd[12951]: Failed password for illegal user 
>> user
>> from 66.246.72.184 port 44262 ssh2
>> Feb 19 08:30:38 eclipse sshd[12953]: Failed password for root from
>> 66.246.72.184 port 44589 ssh2
>> Feb 19 08:30:42 eclipse sshd[12956]: Failed password for root from
>> 66.246.72.184 port 44929 ssh2
>> Feb 19 08:30:45 eclipse sshd[12959]: Failed password for root from
>> 66.246.72.184 port 45220 ssh2
>> Feb 19 08:30:45 eclipse sshd[12961]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 08:30:48 eclipse sshd[12961]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 45522 ssh2
>> Feb 19 08:41:13 eclipse sshd[13118]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 08:41:16 eclipse sshd[13118]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 40004 ssh2
>> Feb 19 08:41:16 eclipse sshd[13124]: Illegal user guest from 
>> 66.246.72.184
>> Feb 19 08:41:19 eclipse sshd[13124]: Failed password for illegal user 
>> guest
>> from 66.246.72.184 port 40330 ssh2
>> Feb 19 08:41:22 eclipse sshd[13127]: Failed password for admin from
>> 66.246.72.184 port 40610 ssh2
>> Feb 19 08:41:25 eclipse sshd[13129]: Failed password for admin from
>> 66.246.72.184 port 40999 ssh2
>> Feb 19 08:41:26 eclipse sshd[13131]: Illegal user user from 
>> 66.246.72.184
>> Feb 19 08:41:28 eclipse sshd[13131]: Failed password for illegal user 
>> user
>> from 66.246.72.184 port 41395 ssh2
>> Feb 19 08:41:31 eclipse sshd[13133]: Failed password for root from
>> 66.246.72.184 port 41834 ssh2
>> Feb 19 08:41:34 eclipse sshd[13135]: Failed password for root from
>> 66.246.72.184 port 42447 ssh2
>> Feb 19 08:41:37 eclipse sshd[13137]: Failed password for root from
>> 66.246.72.184 port 43029 ssh2
>> Feb 19 08:41:38 eclipse sshd[13140]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 08:41:40 eclipse sshd[13140]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 43575 ssh2
>> Feb 19 08:53:54 eclipse sshd[13336]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 08:53:57 eclipse sshd[13336]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 60183 ssh2
>> Feb 19 08:53:57 eclipse sshd[13339]: Illegal user guest from 
>> 66.246.72.184
>> Feb 19 08:54:00 eclipse sshd[13339]: Failed password for illegal user 
>> guest
>> from 66.246.72.184 port 60488 ssh2
>> Feb 19 08:54:03 eclipse sshd[13341]: Failed password for admin from
>> 66.246.72.184 port 60795 ssh2
>> Feb 19 08:54:06 eclipse sshd[13348]: Failed password for admin from
>> 66.246.72.184 port 32829 ssh2
>> Feb 19 08:54:07 eclipse sshd[13351]: Illegal user user from 
>> 66.246.72.184
>> Feb 19 08:54:09 eclipse sshd[13351]: Failed password for illegal user 
>> user
>> from 66.246.72.184 port 33191 ssh2
>> Feb 19 08:54:12 eclipse sshd[13354]: Failed password for root from
>> 66.246.72.184 port 33531 ssh2
>> Feb 19 08:54:15 eclipse sshd[13356]: Failed password for root from
>> 66.246.72.184 port 33874 ssh2
>> Feb 19 08:54:18 eclipse sshd[13359]: Failed password for root from
>> 66.246.72.184 port 34177 ssh2
>> Feb 19 08:54:19 eclipse sshd[13361]: Illegal user test from 
>> 66.246.72.184
>> Feb 19 08:54:21 eclipse sshd[13361]: Failed password for illegal user 
>> test
>> from 66.246.72.184 port 34722 ssh2
>>
>> attack on server 205.200.160.250
>>
>> Feb 19 07:34:52 umbra sshd[9092]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:35:00 umbra sshd[9092]: Failed password for illegal user 
>> test from
>> ::ffff:66.246.72.184 port 52764 ssh2
>> Feb 19 07:35:01 umbra sshd[9106]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 07:35:03 umbra sshd[9106]: Failed password for illegal user guest
>> from ::ffff:66.246.72.184 port 53886 ssh2
>> Feb 19 07:35:06 umbra sshd[9114]: Failed password for admin from
>> ::ffff:66.246.72.184 port 54366 ssh2
>> Feb 19 07:35:10 umbra sshd[9116]: Failed password for admin from
>> ::ffff:66.246.72.184 port 54853 ssh2
>> Feb 19 07:35:10 umbra sshd[9118]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 07:35:13 umbra sshd[9118]: Failed password for illegal user 
>> user from
>> ::ffff:66.246.72.184 port 55426 ssh2
>> Feb 19 07:35:16 umbra sshd[9124]: Failed password for root from
>> ::ffff:66.246.72.184 port 55884 ssh2
>> Feb 19 07:35:19 umbra sshd[9129]: Failed password for root from
>> ::ffff:66.246.72.184 port 56398 ssh2
>> Feb 19 07:35:22 umbra sshd[9131]: Failed password for root from
>> ::ffff:66.246.72.184 port 56922 ssh2
>> Feb 19 07:35:22 umbra sshd[9133]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:35:25 umbra sshd[9133]: Failed password for illegal user 
>> test from
>> ::ffff:66.246.72.184 port 57359 ssh2
>> Feb 19 07:43:43 umbra sshd[9202]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:43:46 umbra sshd[9202]: Failed password for illegal user 
>> test from
>> ::ffff:66.246.72.184 port 44595 ssh2
>> Feb 19 07:43:46 umbra sshd[9204]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 07:43:49 umbra sshd[9204]: Failed password for illegal user guest
>> from ::ffff:66.246.72.184 port 44881 ssh2
>> Feb 19 07:43:52 umbra sshd[9207]: Failed password for admin from
>> ::ffff:66.246.72.184 port 45190 ssh2
>> Feb 19 07:43:55 umbra sshd[9209]: Failed password for admin from
>> ::ffff:66.246.72.184 port 45490 ssh2
>> Feb 19 07:43:56 umbra sshd[9211]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 07:43:58 umbra sshd[9211]: Failed password for illegal user 
>> user from
>> ::ffff:66.246.72.184 port 45811 ssh2
>> Feb 19 07:44:01 umbra sshd[9213]: Failed password for root from
>> ::ffff:66.246.72.184 port 46152 ssh2
>> Feb 19 07:44:04 umbra sshd[9215]: Failed password for root from
>> ::ffff:66.246.72.184 port 46599 ssh2
>> Feb 19 07:44:07 umbra sshd[9217]: Failed password for root from
>> ::ffff:66.246.72.184 port 47042 ssh2
>> Feb 19 07:44:08 umbra sshd[9219]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:44:10 umbra sshd[9219]: Failed password for illegal user 
>> test from
>> ::ffff:66.246.72.184 port 47497 ssh2
>> Feb 19 07:59:07 umbra sshd[9523]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:59:10 umbra sshd[9523]: Failed password for illegal user 
>> test from
>> ::ffff:66.246.72.184 port 42721 ssh2
>> Feb 19 07:59:10 umbra sshd[9525]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 07:59:13 umbra sshd[9525]: Failed password for illegal user guest
>> from ::ffff:66.246.72.184 port 42985 ssh2
>> Feb 19 07:59:16 umbra sshd[9527]: Failed password for admin from
>> ::ffff:66.246.72.184 port 43297 ssh2
>> Feb 19 07:59:19 umbra sshd[9529]: Failed password for admin from
>> ::ffff:66.246.72.184 port 43612 ssh2
>> Feb 19 07:59:20 umbra sshd[9532]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 07:59:22 umbra sshd[9532]: Failed password for illegal user 
>> user from
>> ::ffff:66.246.72.184 port 44084 ssh2
>> Feb 19 07:59:25 umbra sshd[9534]: Failed password for root from
>> ::ffff:66.246.72.184 port 44592 ssh2
>> Feb 19 07:59:28 umbra sshd[9536]: Failed password for root from
>> ::ffff:66.246.72.184 port 45086 ssh2
>> Feb 19 07:59:31 umbra sshd[9538]: Failed password for root from
>> ::ffff:66.246.72.184 port 45497 ssh2
>> Feb 19 07:59:32 umbra sshd[9540]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:59:34 umbra sshd[9540]: Failed password for illegal user 
>> test from
>> ::ffff:66.246.72.184 port 45900 ssh2
>> Feb 19 08:19:25 umbra sshd[9841]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:19:27 umbra sshd[9841]: Failed password for illegal user 
>> test from
>> ::ffff:66.246.72.184 port 34304 ssh2
>> Feb 19 08:19:28 umbra sshd[9844]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 08:19:30 umbra sshd[9844]: Failed password for illegal user guest
>> from ::ffff:66.246.72.184 port 34616 ssh2
>> Feb 19 08:19:34 umbra sshd[9846]: Failed password for admin from
>> ::ffff:66.246.72.184 port 34895 ssh2
>> Feb 19 08:19:37 umbra sshd[9848]: Failed password for admin from
>> ::ffff:66.246.72.184 port 35177 ssh2
>> Feb 19 08:19:37 umbra sshd[9850]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 08:19:40 umbra sshd[9850]: Failed password for illegal user 
>> user from
>> ::ffff:66.246.72.184 port 35469 ssh2
>> Feb 19 08:19:43 umbra sshd[9852]: Failed password for root from
>> ::ffff:66.246.72.184 port 35756 ssh2
>> Feb 19 08:19:46 umbra sshd[9855]: Failed password for root from
>> ::ffff:66.246.72.184 port 36076 ssh2
>> Feb 19 08:19:49 umbra sshd[9860]: Failed password for root from
>> ::ffff:66.246.72.184 port 36363 ssh2
>> Feb 19 08:19:49 umbra sshd[9862]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:19:52 umbra sshd[9862]: Failed password for illegal user 
>> test from
>> ::ffff:66.246.72.184 port 36732 ssh2
>> Feb 19 08:30:21 umbra sshd[10244]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:30:23 umbra sshd[10244]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 43011 ssh2
>> Feb 19 08:30:24 umbra sshd[10246]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 08:30:26 umbra sshd[10246]: Failed password for illegal user 
>> guest
>> from ::ffff:66.246.72.184 port 43345 ssh2
>> Feb 19 08:30:29 umbra sshd[10256]: Failed password for admin from
>> ::ffff:66.246.72.184 port 43652 ssh2
>> Feb 19 08:30:32 umbra sshd[10271]: Failed password for admin from
>> ::ffff:66.246.72.184 port 43939 ssh2
>> Feb 19 08:30:33 umbra sshd[10273]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 08:30:35 umbra sshd[10273]: Failed password for illegal user user
>> from ::ffff:66.246.72.184 port 44259 ssh2
>> Feb 19 08:30:38 umbra sshd[10280]: Failed password for root from
>> ::ffff:66.246.72.184 port 44585 ssh2
>> Feb 19 08:30:41 umbra sshd[10287]: Failed password for root from
>> ::ffff:66.246.72.184 port 44924 ssh2
>> Feb 19 08:30:45 umbra sshd[10294]: Failed password for root from
>> ::ffff:66.246.72.184 port 45213 ssh2
>> Feb 19 08:30:45 umbra sshd[10296]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:30:48 umbra sshd[10296]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 45517 ssh2
>> Feb 19 08:41:13 umbra sshd[10620]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:41:20 umbra sshd[10620]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 40005 ssh2
>> Feb 19 08:41:20 umbra sshd[10634]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 08:41:23 umbra sshd[10634]: Failed password for illegal user 
>> guest
>> from ::ffff:66.246.72.184 port 40707 ssh2
>> Feb 19 08:41:26 umbra sshd[10641]: Failed password for admin from
>> ::ffff:66.246.72.184 port 41119 ssh2
>> Feb 19 08:41:29 umbra sshd[10643]: Failed password for admin from
>> ::ffff:66.246.72.184 port 41571 ssh2
>> Feb 19 08:41:30 umbra sshd[10645]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 08:41:32 umbra sshd[10645]: Failed password for illegal user user
>> from ::ffff:66.246.72.184 port 41981 ssh2
>> Feb 19 08:41:35 umbra sshd[10647]: Failed password for root from
>> ::ffff:66.246.72.184 port 42641 ssh2
>> Feb 19 08:41:38 umbra sshd[10661]: Failed password for root from
>> ::ffff:66.246.72.184 port 43239 ssh2
>> Feb 19 08:41:41 umbra sshd[10666]: Failed password for root from
>> ::ffff:66.246.72.184 port 43755 ssh2
>> Feb 19 08:41:42 umbra sshd[10668]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:41:44 umbra sshd[10668]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 44342 ssh2
>> Feb 19 08:53:54 umbra sshd[10804]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:53:57 umbra sshd[10804]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 60184 ssh2
>> Feb 19 08:53:57 umbra sshd[10806]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 08:54:00 umbra sshd[10806]: Failed password for illegal user 
>> guest
>> from ::ffff:66.246.72.184 port 60486 ssh2
>> Feb 19 08:54:03 umbra sshd[10808]: Failed password for admin from
>> ::ffff:66.246.72.184 port 60794 ssh2
>> Feb 19 08:54:06 umbra sshd[10810]: Failed password for admin from
>> ::ffff:66.246.72.184 port 32824 ssh2
>> Feb 19 08:54:06 umbra sshd[10813]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 08:54:09 umbra sshd[10813]: Failed password for illegal user user
>> from ::ffff:66.246.72.184 port 33185 ssh2
>> Feb 19 08:54:12 umbra sshd[10816]: Failed password for root from
>> ::ffff:66.246.72.184 port 33526 ssh2
>> Feb 19 08:54:15 umbra sshd[10818]: Failed password for root from
>> ::ffff:66.246.72.184 port 33864 ssh2
>> Feb 19 08:54:18 umbra sshd[10820]: Failed password for root from
>> ::ffff:66.246.72.184 port 34173 ssh2
>> Feb 19 08:54:19 umbra sshd[10822]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:54:21 umbra sshd[10822]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 34712 ssh2
>>
>> attack on 205.200.75.113
>>
>> Feb 19 07:33:16 focus sshd[17528]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:33:18 focus sshd[17528]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 54888 ssh2
>> Feb 19 07:33:19 focus sshd[17531]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 07:33:22 focus sshd[17531]: Failed password for illegal user 
>> guest
>> from ::ffff:66.246.72.184 port 55576 ssh2
>> Feb 19 07:33:25 focus sshd[17533]: Failed password for admin from
>> ::ffff:66.246.72.184 port 56060 ssh2
>> Feb 19 07:33:28 focus sshd[17535]: Failed password for admin from
>> ::ffff:66.246.72.184 port 56642 ssh2
>> Feb 19 07:33:29 focus sshd[17537]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 07:33:32 focus sshd[17537]: Failed password for illegal user user
>> from ::ffff:66.246.72.184 port 57172 ssh2
>> Feb 19 07:33:35 focus sshd[17539]: Failed password for root from
>> ::ffff:66.246.72.184 port 57665 ssh2
>> Feb 19 07:33:38 focus sshd[17541]: Failed password for root from
>> ::ffff:66.246.72.184 port 58062 ssh2
>> Feb 19 07:33:42 focus sshd[17543]: Failed password for root from
>> ::ffff:66.246.72.184 port 58605 ssh2
>> Feb 19 07:33:43 focus sshd[17545]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:33:45 focus sshd[17545]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 59091 ssh2
>> Feb 19 07:42:10 focus sshd[17547]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:42:12 focus sshd[17547]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 46611 ssh2
>> Feb 19 07:42:13 focus sshd[17549]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 07:42:15 focus sshd[17549]: Failed password for illegal user 
>> guest
>> from ::ffff:66.246.72.184 port 47076 ssh2
>> Feb 19 07:42:19 focus sshd[17551]: Failed password for admin from
>> ::ffff:66.246.72.184 port 47565 ssh2
>> Feb 19 07:42:22 focus sshd[17553]: Failed password for admin from
>> ::ffff:66.246.72.184 port 48117 ssh2
>> Feb 19 07:42:23 focus sshd[17555]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 07:42:25 focus sshd[17555]: Failed password for illegal user user
>> from ::ffff:66.246.72.184 port 48647 ssh2
>> Feb 19 07:42:28 focus sshd[17557]: Failed password for root from
>> ::ffff:66.246.72.184 port 49018 ssh2
>> Feb 19 07:42:32 focus sshd[17559]: Failed password for root from
>> ::ffff:66.246.72.184 port 49587 ssh2
>> Feb 19 07:42:35 focus sshd[17561]: Failed password for root from
>> ::ffff:66.246.72.184 port 50552 ssh2
>> Feb 19 07:42:36 focus sshd[17563]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:42:38 focus sshd[17563]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 51479 ssh2
>> Feb 19 07:57:34 focus sshd[17567]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:57:37 focus sshd[17567]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 45155 ssh2
>> Feb 19 07:57:37 focus sshd[17569]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 07:57:40 focus sshd[17569]: Failed password for illegal user 
>> guest
>> from ::ffff:66.246.72.184 port 45587 ssh2
>> Feb 19 07:57:43 focus sshd[17571]: Failed password for admin from
>> ::ffff:66.246.72.184 port 46018 ssh2
>> Feb 19 07:57:46 focus sshd[17573]: Failed password for admin from
>> ::ffff:66.246.72.184 port 46617 ssh2
>> Feb 19 07:57:47 focus sshd[17575]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 07:57:50 focus sshd[17575]: Failed password for illegal user user
>> from ::ffff:66.246.72.184 port 47389 ssh2
>> Feb 19 07:57:53 focus sshd[17577]: Failed password for root from
>> ::ffff:66.246.72.184 port 48058 ssh2
>> Feb 19 07:57:56 focus sshd[17579]: Failed password for root from
>> ::ffff:66.246.72.184 port 48681 ssh2
>> Feb 19 07:57:59 focus sshd[17581]: Failed password for root from
>> ::ffff:66.246.72.184 port 49289 ssh2
>> Feb 19 07:58:00 focus sshd[17583]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 07:58:03 focus sshd[17583]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 49990 ssh2
>> Feb 19 08:17:52 focus sshd[17590]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:17:54 focus sshd[17590]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 36145 ssh2
>> Feb 19 08:17:55 focus sshd[17592]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 08:17:58 focus sshd[17592]: Failed password for illegal user 
>> guest
>> from ::ffff:66.246.72.184 port 36433 ssh2
>> Feb 19 08:18:01 focus sshd[17594]: Failed password for admin from
>> ::ffff:66.246.72.184 port 36832 ssh2
>> Feb 19 08:18:04 focus sshd[17596]: Failed password for admin from
>> ::ffff:66.246.72.184 port 37384 ssh2
>> Feb 19 08:18:05 focus sshd[17598]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 08:18:07 focus sshd[17598]: Failed password for illegal user user
>> from ::ffff:66.246.72.184 port 37887 ssh2
>> Feb 19 08:18:11 focus sshd[17600]: Failed password for root from
>> ::ffff:66.246.72.184 port 38297 ssh2
>> Feb 19 08:18:14 focus sshd[17602]: Failed password for root from
>> ::ffff:66.246.72.184 port 38710 ssh2
>> Feb 19 08:18:17 focus sshd[17604]: Failed password for root from
>> ::ffff:66.246.72.184 port 39143 ssh2
>> Feb 19 08:18:18 focus sshd[17606]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:18:20 focus sshd[17606]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 39632 ssh2
>> Feb 19 08:28:48 focus sshd[17609]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:28:50 focus sshd[17609]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 44973 ssh2
>> Feb 19 08:28:51 focus sshd[17611]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 08:28:53 focus sshd[17611]: Failed password for illegal user 
>> guest
>> from ::ffff:66.246.72.184 port 45294 ssh2
>> Feb 19 08:28:57 focus sshd[17613]: Failed password for admin from
>> ::ffff:66.246.72.184 port 45610 ssh2
>> Feb 19 08:29:00 focus sshd[17615]: Failed password for admin from
>> ::ffff:66.246.72.184 port 46093 ssh2
>> Feb 19 08:29:01 focus sshd[17617]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 08:29:03 focus sshd[17617]: Failed password for illegal user user
>> from ::ffff:66.246.72.184 port 46492 ssh2
>> Feb 19 08:29:06 focus sshd[17619]: Failed password for root from
>> ::ffff:66.246.72.184 port 46888 ssh2
>> Feb 19 08:29:10 focus sshd[17621]: Failed password for root from
>> ::ffff:66.246.72.184 port 47313 ssh2
>> Feb 19 08:29:13 focus sshd[17623]: Failed password for root from
>> ::ffff:66.246.72.184 port 47756 ssh2
>> Feb 19 08:29:14 focus sshd[17625]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:29:16 focus sshd[17625]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 48253 ssh2
>> Feb 19 08:39:40 focus sshd[17629]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:39:43 focus sshd[17629]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 42619 ssh2
>> Feb 19 08:39:44 focus sshd[17631]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 08:39:46 focus sshd[17631]: Failed password for illegal user 
>> guest
>> from ::ffff:66.246.72.184 port 43251 ssh2
>> Feb 19 08:39:49 focus sshd[17633]: Failed password for admin from
>> ::ffff:66.246.72.184 port 43804 ssh2
>> Feb 19 08:39:53 focus sshd[17635]: Failed password for admin from
>> ::ffff:66.246.72.184 port 44460 ssh2
>> Feb 19 08:39:53 focus sshd[17637]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 08:39:56 focus sshd[17637]: Failed password for illegal user user
>> from ::ffff:66.246.72.184 port 45006 ssh2
>> Feb 19 08:39:59 focus sshd[17639]: Failed password for root from
>> ::ffff:66.246.72.184 port 45572 ssh2
>> Feb 19 08:40:02 focus sshd[17641]: Failed password for root from
>> ::ffff:66.246.72.184 port 46200 ssh2
>> Feb 19 08:40:06 focus sshd[17643]: Failed password for root from
>> ::ffff:66.246.72.184 port 46828 ssh2
>> Feb 19 08:40:06 focus sshd[17645]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:40:09 focus sshd[17645]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 47342 ssh2
>> Feb 19 08:52:21 focus sshd[17648]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:52:24 focus sshd[17648]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 33945 ssh2
>> Feb 19 08:52:24 focus sshd[17650]: Illegal user guest from
>> ::ffff:66.246.72.184
>> Feb 19 08:52:27 focus sshd[17650]: Failed password for illegal user 
>> guest
>> from ::ffff:66.246.72.184 port 34376 ssh2
>> Feb 19 08:52:30 focus sshd[17652]: Failed password for admin from
>> ::ffff:66.246.72.184 port 34961 ssh2
>> Feb 19 08:52:33 focus sshd[17654]: Failed password for admin from
>> ::ffff:66.246.72.184 port 35620 ssh2
>> Feb 19 08:52:34 focus sshd[17656]: Illegal user user from
>> ::ffff:66.246.72.184
>> Feb 19 08:52:37 focus sshd[17656]: Failed password for illegal user user
>> from ::ffff:66.246.72.184 port 36193 ssh2
>> Feb 19 08:52:40 focus sshd[17658]: Failed password for root from
>> ::ffff:66.246.72.184 port 36791 ssh2
>> Feb 19 08:52:43 focus sshd[17660]: Failed password for root from
>> ::ffff:66.246.72.184 port 37355 ssh2
>> Feb 19 08:52:46 focus sshd[17662]: Failed password for root from
>> ::ffff:66.246.72.184 port 37920 ssh2
>> Feb 19 08:52:47 focus sshd[17664]: Illegal user test from
>> ::ffff:66.246.72.184
>> Feb 19 08:52:50 focus sshd[17664]: Failed password for illegal user test
>> from ::ffff:66.246.72.184 port 38452 ssh2
>>
>> [email protected]                      http://www.shadowplay.net
>> Phone:  204.284.3481                      Toll Free: 866.590.0023
>> Mobile: 204.470.9158
>>
>> FOR CLIENT SUPPORT PLEASE CALL 204.470.9021
>> or email [email protected]
>>
>> _______________________________________________
>> Intrusions mailing list
>> [email protected]
>> http://www.dshield.org/mailman/listinfo/intrusions
>>
>>   
>
>
>
>  



_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions