Re: Anyone else seeing a spike in SSHd scans?

From: Dave Laird <dlaird(at)kharma.net>
Date: Sun Jun 29 2003 - 13:03:09 EDT

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Good morning...

On Sunday 29 June 2003 9:12 am, p00p@instable.net wrote:

> one thing that could be of interesting note is that comcast IS now

It would seem that way, yes. The returns I've seen, thus far, all come from ne.attbi.com which would tend to make think so. For the time being, I've blocked their IP block in the firewall until I get some kind of meaningful response from ATT. Coincidentally, in a similar frame of reference, about this same time I noted a sudden surge of SPAM e-mail hitting my mail filters from that same address just prior to when I blocked the IP. <grin> I think the admins that once maintained attbi.com are now working frantically on the comcast network, but I could be wrong.

Dave
- --
Dave Laird (Dave@kharma.net)
The Used Kharma Lot / The Phoenix Project Web Page: http://www.kharma.net updated 04/15/2003 Usenet News server: news.kharma.net
Musicians Calendar and Database access: http://www.kharma.net/calendar.html                                            

An automatic & random thought For the Minute: Collaboration, n.:

	A literary partnership based on the false assumption that the
	other fellow can spell.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+/xvNZx0/eWCCG/wRAgIcAJwM2gOc/IlZPh45yLY0bM6jB7ck3QCfUCTX 1v/rfpn+OmZ/MrKYRHfWxGs=
=HnnC
-----END PGP SIGNATURE-----

---

Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the world's premier technical IT security event! 10 tracks, 15 training sessions, 1,800 delegates from 30 nations including all of the top experts, from CSO's to "underground" security specialists. See for yourself what the buzz is about! Early-bird registration ends July 3. This event will sell out. www.blackhat.com

---

Received on Sun Jun 29 19:25:54 2003