*SHORT* summary of some of the attacks against us for Dec. 2008 Just too many scans and not enough time to keep the list up all the time so... some of the more intresting/annoying scans/attacks, or 1 day samples are here And we won't even THINK about the 1 scan per minute or more on ssh for Nov and Dec year - time EASTERN source_ip[:port] (dns name, if any) attack/scan/notes 2008/12/10-16:38:15.93 start of odd scan I noticed 2008/12/10-16:38:15.93 207.173.203.254 ftp scan on bobcat with USER ent PASS FUCKED666 2008/12/10-16:38:16.94 207.173.203.254 ftp scan on bobcat with USER ent PASS 123 2008/12/10-16:38:15.07 207.173.203.254 ftp scan on bobcat with USER ent PASS 123456 2008/12/10-16:38:15.07 207.173.203.254 ftp scan on bobcat with USER ent PASS abc123 2008/12/10-16:38:15.07 207.173.203.254 ftp scan on bobcat with USER ent PASS 123abc 2008/12/10-16:38:15.07 207.173.203.254 ftp scan on bobcat with USER ent PASS password 2008/12/10-16:38:15.07 207.173.203.254 ftp scan on bobcat with USER ent PASS qwerty 2008/12/10-16:38:15.07 207.173.203.254 ftp scan on bobcat with USER ent PASS zxc 2008/12/10-16:38:15.07 207.173.203.254 ftp scan on bobcat with USER ent PASS "" 2008/12/12-00:06:09.17 Day 2 of scan.. 2008/12/12-00:06:09.17 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS nobody 2008/12/12-00:06:09.17 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 4321 2008/12/12-00:06:07.09 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS manager 2008/12/12-00:06:07.09 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 2008/12/12-00:02:56.24 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS web 2008/12/12-00:02:55.29 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS admin 2008/12/12-00:02:55.30 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS info 2008/12/12-00:06:04.99 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS ftpuser 2008/12/12-00:02:55.30 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS download 2008/12/12-00:06:05.96 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS qwerty 2008/12/12-00:06:05.06 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS upload 2008/12/12-00:02:55.29 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS video 2008/12/12-00:02:55.29 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS image 2008/12/12-00:02:55.30 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS webadmin 2008/12/12-00:06:05.02 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS rootadmin 2008/12/12-00:02:55.29 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS webmaster 2008/12/12-00:06:05.03 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS stuff 2008/12/12-00:06:06.96 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS cvs 2008/12/12-00:06:05.02 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS data 2008/12/12-00:02:55.30 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS transfer 2008/12/12-00:06:07.94 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS help 2008/12/12-00:06:08.97 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS editor 2008/12/12-00:06:05.03 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS server 2008/12/12-00:02:55.29 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS system 2008/12/12-00:06:05.02 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS fedora 2008/12/12-00:06:08.99 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS page 2008/12/12-00:06:05.06 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS webwww 2008/12/12-00:06:06.96 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS home 2008/12/12-00:06:08.99 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS new 2008/12/12-00:06:05.96 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS test 2008/12/12-00:06:04.93 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS designer 2008/12/12-00:06:04.95 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS password 2008/12/12-00:06:05.11 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS reseller 2008/12/12-00:06:05.04 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS sites 2008/12/12-00:06:05.08 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS virtual 2008/12/12-00:06:07.97 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 123456789 2008/12/12-00:06:05.11 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 12345678 2008/12/12-00:06:05.02 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 1234567 2008/12/12-00:06:04.99 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 987654321 2008/12/12-00:06:05.08 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 123456 2008/12/12-00:06:05.14 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 12345 2008/12/12-00:06:05.25 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 1234 2008/12/12-00:06:05.41 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 123 2008/12/12-00:06:05.40 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 87654321 2008/12/12-00:06:05.28 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 7654321 2008/12/12-00:06:05.49 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 654321 2008/12/12-00:06:05.49 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 54321 2008/12/12-00:06:10.09 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS user 2008/12/12-00:06:10.07 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS master 2008/12/12-00:06:10.14 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS down 2008/12/12-00:06:10.12 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS list 2008/12/12-00:06:10.19 207.218.134.76 ftp scan on bobcat with ent ---ftp-login--- PASS 1234567890 2008/12/14-21:22:05.81 -- and here I thought they went away :-( 2008/12/14-21:22:05.81 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS qwerty 2008/12/14-21:22:04.95 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS abc 2008/12/14-21:22:04.92 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS abc123 2008/12/14-21:22:04.93 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 123 2008/12/14-21:22:05.20 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 123abc 2008/12/14-21:24:13.38 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS mike 2008/12/14-21:24:13.42 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS john 2008/12/14-21:22:05.20 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS garry 2008/12/14-21:24:13.36 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS michael 2008/12/14-21:24:13.41 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS god 2008/12/14-21:24:13.36 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS don 2008/12/14-21:24:13.35 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS andrew 2008/12/14-21:24:13.45 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS nicholas 2008/12/14-21:24:13.45 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS enquiry 2008/12/14-21:24:13.38 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS alex 2008/12/14-21:24:13.33 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS jason 2008/12/14-21:22:05.21 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS amanda 2008/12/14-21:22:05.21 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS sasha 2008/12/14-21:24:15.45 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS test1 2008/12/14-21:24:14.45 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS testing 2008/12/14-21:24:13.41 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS ftpuser 2008/12/14-21:24:16.41 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS charles 2008/12/14-21:22:06.21 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 87654321 2008/12/14-21:22:06.21 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 7654321 2008/12/14-21:24:13.33 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 654321 2008/12/14-21:24:13.55 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 54321 2008/12/14-21:22:06.21 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 4321 2008/12/14-21:22:06.21 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 321 2008/12/14-21:24:13.43 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS cindy 2008/12/14-21:24:13.49 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS bill 2008/12/14-21:24:13.30 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS david 2008/12/14-21:24:13.47 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 2008/12/14-21:24:13.53 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 1234 2008/12/14-21:24:13.45 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 12345 2008/12/14-21:24:17.47 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 123456 2008/12/14-21:24:13.51 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 1234567 2008/12/14-21:24:13.56 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 12345678 2008/12/14-21:24:13.52 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 123456789 2008/12/14-21:24:13.54 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 1234567890 2008/12/14-21:24:13.55 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS password 2008/12/14-21:24:13.27 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS admin 2008/12/14-21:24:13.43 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS check 2008/12/14-21:24:18.58 85.113.250.220 132.235.17.1 USER ent ---ftp-login--- PASS 987654321