[nycbug-talk] new bruteforcing. . .

[Peter Wright]

> On Mon, 22 Oct 2007, George Rosamond wrote:
>
>> I noticed this happening to some of our boxes last night while tailing
>> some logs:
>>
>> http://isc.sans.org/diary.html?storyid=3529
>>
>> Anyone else notice this going on?
>
> I saw more in my logs on the few boxes open to the world, but pf is nuking
> them nicely after a few tries (and we don't allow non-key logins anyhow).
>
> One mystery though with the old scanner bots that I never figured out was
> what is the deal with "fluffy"??
>
> Oct 12 07:57:18 miko sshd[99893]: Invalid user fluffy from 87.30.69.11
> Oct 16 08:01:32 miko sshd[41118]: Invalid user fluffy from 121.162.217.27
>
> I understand "root", "admin", "staff", etc.  But fluffy??
>

/me rushes to change his admin login from fluffy to something less obvious ;)

-pete



-- 
~~oO00Oo~~
Peter Wright
pete at nomadlogic.org
www.nomadlogic.org/~pete
310.869.9459