Q? Do YOU report scans to abuse, or let them go?

haertig · 06-10-2006, 03:30 PM

Just wondering ... do people here report scans to abuse@isp.whatever?

Not that the script-kiddies successfully get in (so far!) I'm just wondering if people here tend to report or ignore. Things like the following (my adaptive firewall shut down the nonsense after three attempts):

Code:

Jun 10 12:42:14 xxx sshd[29550]: Connection from 211.239.157.232 port 39808
Jun 10 12:42:16 xxx sshd[29550]: User root from 211.239.157.232 not allowed ...
Jun 10 12:42:16 xxx sshd[29560]: Connection from 211.239.157.232 port 39857
Jun 10 12:42:18 xxx sshd[29560]: User root from 211.239.157.232 not allowed ...
Jun 10 12:42:19 xxx sshd[29568]: Connection from 211.239.157.232 port 39914
Jun 10 12:42:21 xxx sshd[29568]: User root from 211.239.157.232 not allowed ...
Jun 10 12:42:21 xxx sshd[29577]: refused connect from 211.239.157.232 ...

macemoneta · 06-10-2006, 05:26 PM

Ignore. I've been scanned nearly continuously for 6 years now. If I had decided to report each scan or unauthorized access attempt, it would have become a full time job. Not that anyone does anything with abuse reports (I think they are mostly routed to /dev/null).

////// · 06-10-2006, 11:43 PM

http://www.mynetwatchman.com/

Easy to configure, just register, install & start daemon and let it run.

Notwerk · 06-12-2006, 06:55 AM

If the tries are serious, i.e. they're not just trying random username/password combinations but trying one username "root" for example and many passwords (brute force???) AND the make a whole lot of tries (like two or three days running) then I report them. Otherwise, ignore

fedora4002 · 06-12-2006, 11:28 AM

I tried to contact several ISPs which has users ssh scanning us. They did response and promised to let their users know. But the scanning is continuing. That's it.