FBI probes network breach at Stanford

TalkBack 12 of 17:

Next »

« Previous

• Thread View
• Flat View

From one of my security logs

Here's a typical log extract from one of the servers I babysit:

218.232.187.58 is a Korean mchine, 206.53.51.50 is Canadian.

Every day, every server, on average about 2 login attempts a second to each machine. The times are GMT if anyone recognises their subnet.

May 22 12:34:42 host sshd[21787]: Failed password for root from ::ffff:218.232.187.58 port 38341 ssh2
May 22 12:34:44 host sshd[21789]: Failed password for root from ::ffff:218.232.187.58 port 38357 ssh2
May 22 12:34:47 host sshd[21791]: Failed password for root from ::ffff:218.232.187.58 port 38389 ssh2
May 22 12:34:47 host sshd[21793]: Failed password for root from ::ffff:218.232.187.58 port 38397 ssh2
May 22 12:34:51 host sshd[21795]: Failed password for root from ::ffff:218.232.187.58 port 38451 ssh2
May 22 12:57:09 host sshd[21903]: Illegal user test from ::ffff:206.53.51.50
May 22 12:57:10 host sshd[21902]: Illegal user test from ::ffff:206.53.51.50
May 22 12:57:10 host sshd[21905]: Illegal user test from ::ffff:206.53.51.50
May 22 12:57:12 host sshd[21903]: Failed password for illegal user test from ::ffff:206.53.51.50 port 36003 ssh2
May 22 12:57:12 host sshd[21902]: Failed password for illegal user test from ::ffff:206.53.51.50 port 36001 ssh2
May 22 12:57:12 host sshd[21905]: Failed password for illegal user test from ::ffff:206.53.51.50 port 36013 ssh2
May 22 12:57:13 host sshd[21908]: Illegal user guest from ::ffff:206.53.51.50
May 22 12:57:13 host sshd[21910]: Illegal user guest from ::ffff:206.53.51.50
May 22 12:57:13 host sshd[21911]: Illegal user guest from ::ffff:206.53.51.50
May 22 12:57:15 host sshd[21908]: Failed password for illegal user guest from ::ffff:206.53.51.50 port 36089 ssh2
May 22 12:57:15 host sshd[21910]: Failed password for illegal user guest from ::ffff:206.53.51.50 port 36098 ssh2
May 22 12:57:16 host sshd[21911]: Failed password for illegal user guest from ::ffff:206.53.51.50 port 36101 ssh2
May 22 12:57:16 host sshd[21914]: Illegal user admin from ::ffff:206.53.51.50
May 22 12:57:16 host sshd[21916]: Illegal user admin from ::ffff:206.53.51.50
May 22 12:57:17 host sshd[21918]: Illegal user admin from ::ffff:206.53.51.50
May 22 12:57:18 host sshd[21914]: Failed password for illegal user admin from ::ffff:206.53.51.50 port 36178 ssh2
May 22 12:57:19 host sshd[21916]: Failed password for illegal user admin from ::ffff:206.53.51.50 port 36188 ssh2
May 22 12:57:19 host sshd[21918]: Failed password for illegal user admin from ::ffff:206.53.51.50 port 36203 ssh2
May 22 12:57:19 host sshd[21920]: Illegal user admin from ::ffff:206.53.51.50
May 22 12:57:20 host sshd[21922]: Illegal user admin from ::ffff:206.53.51.50
May 22 12:57:20 host sshd[21924]: Illegal user admin from ::ffff:206.53.51.50
May 22 12:57:22 host sshd[21920]: Failed password for illegal user admin from ::ffff:206.53.51.50 port 36262 ssh2
May 22 12:57:22 host sshd[21922]: Failed password for illegal user admin from ::ffff:206.53.51.50 port 36274 ssh2
May 22 12:57:22 host sshd[21924]: Failed password for illegal user admin from ::ffff:206.53.51.50 port 36288 ssh2
May 22 12:57:23 host sshd[21926]: Illegal user user from ::ffff:206.53.51.50
May 22 12:57:23 host sshd[21928]: Illegal user user from ::ffff:206.53.51.50
May 22 12:57:25 host sshd[21929]: Illegal user user from ::ffff:206.53.51.50
....
May 26 07:07:41 host sshd[12895]: Failed password for illegal user mike from ::ffff:216.187.69.118 port 45087 ssh2
May 26 07:07:41 host sshd[12897]: Failed password for illegal user mike from ::ffff:216.187.69.118 port 45091 ssh2
May 26 07:07:42 host sshd[12899]: Failed password for illegal user mike from ::ffff:216.187.69.118 port 45111 ssh2
May 26 07:07:42 host sshd[12901]: Illegal user mike from ::ffff:216.187.69.118
May 26 07:07:43 host sshd[12903]: Illegal user mike from ::ffff:216.187.69.118
May 26 07:07:43 host sshd[12905]: Illegal user mike from ::ffff:216.187.69.118
May 26 07:07:45 host sshd[12901]: Failed password for illegal user mike from ::ffff:216.187.69.118 port 45236 ssh2
May 26 07:07:45 host sshd[12903]: Failed password for illegal user mike from ::ffff:216.187.69.118 port 45242 ssh2
May 26 07:07:45 host sshd[12905]: Failed password for illegal user mike from ::ffff:216.187.69.118 port 45258 ssh2
May 26 07:07:46 host sshd[12907]: Illegal user stephanie from ::ffff:216.187.69.118
May 26 07:07:46 host sshd[12909]: Illegal user stephanie from ::ffff:216.187.69.118
May 26 07:07:46 host sshd[12911]: Illegal user stephanie from ::ffff:216.187.69.118
May 26 07:07:48 host sshd[12907]: Failed password for illegal user stephanie from ::ffff:216.187.69.118 port 45383 ssh2
May 26 07:07:48 host sshd[12909]: Failed password for illegal user stephanie from ::ffff:216.187.69.118 port 45389 ssh2
May 26 07:07:49 host sshd[12911]: Failed password for illegal user stephanie from ::ffff:216.187.69.118 port 45405 ssh2
May 26 07:07:49 host sshd[12913]: Illegal user stephanie from ::ffff:216.187.69.118
May 26 07:07:50 host sshd[12915]: Illegal user stephanie from ::ffff:216.187.69.118
May 26 07:07:50 host sshd[12917]: Illegal user stephanie from ::ffff:216.187.69.118
May 26 07:07:52 host sshd[12913]: Failed password for illegal user stephanie from ::ffff:216.187.69.118 port 45531 ssh2
May 26 07:07:52 host sshd[12915]: Failed password for illegal user stephanie from ::ffff:216.187.69.118 port 45537 ssh2
May 26 07:07:52 host sshd[12917]: Failed password for illegal user stephanie from ::ffff:216.187.69.118 port 45554 ssh2
May 26 07:07:53 host sshd[12919]: Illegal user stephanie from ::ffff:216.187.69.118
May 26 07:07:53 host sshd[12921]: Illegal user stephanie from ::ffff:216.187.69.118
May 26 07:07:53 host sshd[12923]: Illegal user stephanie from ::ffff:216.187.69.118
May 26 07:07:55 host sshd[12919]: Failed password for illegal user stephanie from ::ffff:216.187.69.118 port 45682 ssh2
May 26 07:07:55 host sshd[12921]: Failed password for illegal user stephanie from ::ffff:216.187.69.118 port 45688 ssh2
May 26 07:07:56 host sshd[12923]: Failed password for illegal user stephanie from ::ffff:216.187.69.118 port 45701 ssh2
May 26 07:07:57 host sshd[12925]: Illegal user jannys from ::ffff:216.187.69.118
May 26 07:07:57 host sshd[12926]: Illegal user jannys from ::ffff:216.187.69.118
May 26 07:07:57 host sshd[12929]: Illegal user jannys from ::ffff:216.187.69.118
May 26 07:07:59 host sshd[12925]: Failed password for illegal user jannys from ::ffff:216.187.69.118 port 45831 ssh2
May 26 07:07:59 host sshd[12926]: Failed password for illegal user jannys from ::ffff:216.187.69.118 port 45837 ssh2
May 26 07:07:59 host sshd[12929]: Failed password for illegal user jannys from ::ffff:216.187.69.118 port 45851 ssh2
May 26 07:08:00 host sshd[12931]: Illegal user jannys from ::ffff:216.187.69.118
May 26 07:08:00 host sshd[12933]: Illegal user jannys from ::ffff:216.187.69.118
May 26 07:08:01 host sshd[12935]: Illegal user jannys from ::ffff:216.187.69.118
May 26 07:08:02 host sshd[12931]: Failed password for illegal user jannys from ::ffff:216.187.69.118 port 45977 ssh2
May 26 07:08:03 host sshd[12933]: Failed password for illegal user jannys from ::ffff:216.187.69.118 port 45984 ssh2
May 26 07:08:03 host sshd[12935]: Failed password for illegal user jannys from ::ffff:216.187.69.118 port 46002 ssh2
May 26 07:08:04 host sshd[12937]: Illegal user jannys from ::ffff:216.187.69.118
May 26 07:08:04 host sshd[12939]: Illegal user jannys from ::ffff:216.187.69.118
May 26 07:08:04 host sshd[12941]: Illegal user jannys from ::ffff:216.187.69.118


And some more IPs (again hundreds of attempts):
203.125.102.105 is from Singapore, 83.103.20.0 Italy. 72.11.98.138 is USA.

May 10 16:55:44 host sshd[16305]: Failed password for illegal user scott from ::ffff:203.125.102.105 port 53911 ssh2

May 12 13:18:27 host sshd[16238]: Failed password for illegal user webadmin from ::ffff:83.103.20.0 port 58260 ssh2

May 12 14:59:41 host sshd[17855]: Failed password for illegal user stephen from ::ffff:72.11.98.138 port 54860 ssh2

Posted by: Nigel Johnstone   Posted on: 05/26/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Building the Virtualized Enterprise with VMware Infrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now