Interesting SSH attack from 216.75.199.3 ... / 2011-01-25

2011-01-25 Interesting SSH attack from 216.75.199.3 ...
Interesting SSH attack from 216.75.199.33. All attempts for root and the attacker takes fail2ban default settings into account. The attack waits about half an hour when there is no reply.
17:14:37.332569 IP 216.75.199.33.56158 > mm.nn.oo.pp.22: S 3208575306:3208575306(0) win 5840 <mss 1380,sackOK,timestamp 2532346093 0,nop,wscale 2>
17:14:40.332240 IP 216.75.199.33.56158 > mm.nn.oo.pp.22: S 3208575306:3208575306(0) win 5840 <mss 1380,sackOK,timestamp 2532349093 0,nop,wscale 2>
17:14:46.332290 IP 216.75.199.33.56158 > mm.nn.oo.pp.22: S 3208575306:3208575306(0) win 5840 <mss 1380,sackOK,timestamp 2532355093 0,nop,wscale 2>

17:47:48.498287 IP 216.75.199.33.3446 > mm.nn.oo.pp.22: S 982440641:982440641(0) win 5840 <mss 1380,sackOK,timestamp 2534337258 0,nop,wscale 2>
17:47:51.497769 IP 216.75.199.33.3446 > mm.nn.oo.pp.22: S 982440641:982440641(0) win 5840 <mss 1380,sackOK,timestamp 2534340258 0,nop,wscale 2>
17:47:57.498146 IP 216.75.199.33.3446 > mm.nn.oo.pp.22: S 982440641:982440641(0) win 5840 <mss 1380,sackOK,timestamp 2534346258 0,nop,wscale 2>
Too bad I changed the defaults.

Tags: ,

IPv6 check

Running test...
, reachable as koos+website@idefix.net. PGP encrypted e-mail preferred. PGP key 5BA9 368B E6F3 34E4 local copy PGP key 5BA9 368B E6F3 34E4 via keyservers

RSS
Meningen zijn die van mezelf, wat ik schrijf is beschermd door auteursrecht. Sommige publicaties bevatten een expliciete vermelding dat ze ongevraagd gedeeld mogen worden.
My opinions are my own, what I write is protected by copyrights. Some publications contain an explicit license statement which allows sharing without asking permission.
Other webprojects: Camp Wireless, wireless Internet access at campsites, The Virtual Bookcase, book reviews
This page generated by $Id: newsitem.cgi,v 1.55 2021/11/09 13:09:49 koos Exp $ in 0.005735 seconds.