#passwordgroping — Public Fediverse posts

oh, somebot is in trouble:

May 25 13:26:54 skapet sshd-session[30936]: Failed password for invalid user Can't open exe from 2a02:4780:10:8ba4::1 port 34842 ssh2
May 25 13:26:56 skapet sshd-session[92221]: Failed password for invalid user Can't open exe from 2a02:4780:10:8ba4::1 port 34856 ssh2

#ssh #sshgropers #passwordgroping #passwordguessing #bots #botnets #cybercrime

oh, somebot is in trouble:

May 25 13:26:54 skapet sshd-session[30936]: Failed password for invalid user Can't open exe from 2a02:4780:10:8ba4::1 port 34842 ssh2
May 25 13:26:56 skapet sshd-session[92221]: Failed password for invalid user Can't open exe from 2a02:4780:10:8ba4::1 port 34856 ssh2

#ssh #sshgropers #passwordgroping #passwordguessing #bots #botnets #cybercrime

Yes, this happened:

May 23 09:54:39 skapet sshd-session[44948]: Failed password for invalid user root/1234567 from 109.248.231.249 port 52134 ssh2

Must have worked *somewhere* at least *once*, right?

#cybercrime #ssh #passwordgroping #passwordguessing #morons #scriptkiddies

Yes, this happened:

May 23 09:54:39 skapet sshd-session[44948]: Failed password for invalid user root/1234567 from 109.248.231.249 port 52134 ssh2

Must have worked *somewhere* at least *once*, right?

#cybercrime #ssh #passwordgroping #passwordguessing #morons #scriptkiddies

Oh, so somebot thought this would work:

May 20 04:04:16 portal sshd-session[90553]: Failed password for invalid user $ from 23.94.213.157 port 41886 ssh2

#ssh #passwordgroping #botnets #bots #cybercrime

Oh, so somebot thought this would work:

May 20 04:04:16 portal sshd-session[90553]: Failed password for invalid user $ from 23.94.213.157 port 41886 ssh2

#ssh #passwordgroping #botnets #bots #cybercrime

yes, this happened:

Apr 8 23:46:59 skapet sshd-session[69515]: Failed none for invalid user Can't locate List/Util.pm in @INC (you may need to install the List from 175.199.67.164 port 51226 ssh2

(and several times more, of course)
#ssh #bot #botnet #passwordgroping #passwordguessing #sshgropers #cybercrime #security

Background: "Badness, Enumerated by Robots" https://nxdomain.no/~peter/badness_enumerated_by_robots.html and links therein

yes, this happened:

Apr 8 23:46:59 skapet sshd-session[69515]: Failed none for invalid user Can't locate List/Util.pm in @INC (you may need to install the List from 175.199.67.164 port 51226 ssh2

(and several times more, of course)
#ssh #bot #botnet #passwordgroping #passwordguessing #sshgropers #cybercrime #security

Background: "Badness, Enumerated by Robots" https://nxdomain.no/~peter/badness_enumerated_by_robots.html and links therein

A mention elsewhere of the insufferable ssh password guessers has me reprise my "The Hail Mary Cloud and the Lessons Learned" https://nxdomain.no/~peter/hailmary_lessons_learned.html piece, with a note added at the end about endlessh as a possible refinement (yes, I use it) #ssh #passwords #passwordguessing #passwordgroping #endlessh #openbsd #freebsd #pf #packetfilter #security #cybercrime

A mention elsewhere of the insufferable ssh password guessers has me reprise my "The Hail Mary Cloud and the Lessons Learned" https://nxdomain.no/~peter/hailmary_lessons_learned.html piece, with a note added at the end about endlessh as a possible refinement (yes, I use it) #ssh #passwords #passwordguessing #passwordgroping #endlessh #openbsd #freebsd #pf #packetfilter #security #cybercrime

Over at LinkedIn, somebody posted the results of putting a Linux server with sshd exposted to the internet for 30 days recently.

In that particular area, not much seems to have changed since the early years of this century when the events chronicled here https://nxdomain.no/~peter/hailmary_lessons_learned.html (or if you prefer Big G's trackers, https://bsdly.blogspot.com/2013/10/the-hail-mary-cloud-and-lessons-learned.html) occurred.

#ssh #passwordguessing #rootlogin #weakspaswords #passwordgroping #cybercrime

Over at LinkedIn, somebody posted the results of putting a Linux server with sshd exposted to the internet for 30 days recently.

In that particular area, not much seems to have changed since the early years of this century when the events chronicled here https://nxdomain.no/~peter/hailmary_lessons_learned.html (or if you prefer Big G's trackers, https://bsdly.blogspot.com/2013/10/the-hail-mary-cloud-and-lessons-learned.html) occurred.

#ssh #passwordguessing #rootlogin #weakspaswords #passwordgroping #cybercrime

Possibly not blogworthy, but: One puzzling side effect of running greytrapping (as chronicled in https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html) is seeing the uptick in password guessing using even the obviously generated gibberish local parts, and the sheer volume of tries (see https://nxdomain.no/~peter/should_i_stop_caring_and_let_ip_reputation_sort_them_out.html and links therein). #greytrapping #passwordguessing #passwordgroping #spamd #ssh #pop3gropers

Possibly not blogworthy, but: One puzzling side effect of running greytrapping (as chronicled in https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html) is seeing the uptick in password guessing using even the obviously generated gibberish local parts, and the sheer volume of tries (see https://nxdomain.no/~peter/should_i_stop_caring_and_let_ip_reputation_sort_them_out.html and links therein). #greytrapping #passwordguessing #passwordgroping #spamd #ssh #pop3gropers

Possibly not blogworthy, but: One puzzling side effect of running greytrapping (as chronicled in https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html) is seeing the uptick in password guessing using even the obviously generated gibberish local parts, and the sheer volume of tries (see https://nxdomain.no/~peter/should_i_stop_caring_and_let_ip_reputation_sort_them_out.html and links therein). #greytrapping #passwordguessing #passwordgroping #spamd #ssh #pop3gropers

Possibly not blogworthy, but: One puzzling side effect of running greytrapping (as chronicled in https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html) is seeing the uptick in password guessing using even the obviously generated gibberish local parts, and the sheer volume of tries (see https://nxdomain.no/~peter/should_i_stop_caring_and_let_ip_reputation_sort_them_out.html and links therein). #greytrapping #passwordguessing #passwordgroping #spamd #ssh #pop3gropers

Possibly not blogworthy, but: One puzzling side effect of running greytrapping (as chronicled in https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html) is seeing the uptick in password guessing using even the obviously generated gibberish local parts, and the sheer volume of tries (see https://nxdomain.no/~peter/should_i_stop_caring_and_let_ip_reputation_sort_them_out.html and links therein). #greytrapping #passwordguessing #passwordgroping #spamd #ssh #pop3gropers

This is what a #bugbounty hunt looks like, right? https://nxdomain.no/~peter/20251206_bugbounnty_hunter_at_work.txt #securityresearch #scriptkiddies #morons #wordpress #passwordgroping

This is what a #bugbounty hunt looks like, right? https://nxdomain.no/~peter/20251206_bugbounnty_hunter_at_work.txt #securityresearch #scriptkiddies #morons #wordpress #passwordgroping

Hm. Over at the facesite I commented on a post about #bruteforce attacks on a commercial network product with a link to https://nxdomain.no/~peter/badness_enumerated_by_robots.html, and got a followup asking whether I have bruteforce protection "in front of" my ssh servers.

And this only hours after I scared the cat by LOL from seeing that the #pop3gropers are actively trying the local parts of my freshly random spamtraps (see https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html a bit down the page). #passwordgroping #cybercrime

Hm. Over at the facesite I commented on a post about #bruteforce attacks on a commercial network product with a link to https://nxdomain.no/~peter/badness_enumerated_by_robots.html, and got a followup asking whether I have bruteforce protection "in front of" my ssh servers.

And this only hours after I scared the cat by LOL from seeing that the #pop3gropers are actively trying the local parts of my freshly random spamtraps (see https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html a bit down the page). #passwordgroping #cybercrime

Hm. Over at the facesite I commented on a post about #bruteforce attacks on a commercial network product with a link to https://nxdomain.no/~peter/badness_enumerated_by_robots.html, and got a followup asking whether I have bruteforce protection "in front of" my ssh servers.

And this only hours after I scared the cat by LOL from seeing that the #pop3gropers are actively trying the local parts of my freshly random spamtraps (see https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html a bit down the page). #passwordgroping #cybercrime

Hm. Over at the facesite I commented on a post about #bruteforce attacks on a commercial network product with a link to https://nxdomain.no/~peter/badness_enumerated_by_robots.html, and got a followup asking whether I have bruteforce protection "in front of" my ssh servers.

And this only hours after I scared the cat by LOL from seeing that the #pop3gropers are actively trying the local parts of my freshly random spamtraps (see https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html a bit down the page). #passwordgroping #cybercrime

Hm. Over at the facesite I commented on a post about #bruteforce attacks on a commercial network product with a link to https://nxdomain.no/~peter/badness_enumerated_by_robots.html, and got a followup asking whether I have bruteforce protection "in front of" my ssh servers.

And this only hours after I scared the cat by LOL from seeing that the #pop3gropers are actively trying the local parts of my freshly random spamtraps (see https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html a bit down the page). #passwordgroping #cybercrime

On a similar note, idle minds might wonder what "luax" is - log excerpt https://nxdomain.no/~peter/who_or_what_is_luax.txt #luax #ssh #sshgropers #passwordgroping #passwordguessing #cybercrime #security #bots

On a similar note, idle minds might wonder what "luax" is - log excerpt https://nxdomain.no/~peter/who_or_what_is_luax.txt #luax #ssh #sshgropers #passwordgroping #passwordguessing #cybercrime #security #bots

just got to love these:

Oct 4 00:04:31 portal sshd-session[37449]: Failed password for invalid user { from 114.111.54.188 port 49944 ssh2

#ssh #passwords #passwordguessing #passwordgroping #cybercrime #bots

just got to love these:

Oct 4 00:04:31 portal sshd-session[37449]: Failed password for invalid user { from 114.111.54.188 port 49944 ssh2

#ssh #passwords #passwordguessing #passwordgroping #cybercrime #bots

The long version of why you need key authentication for your SSH servers - "The Hail Mary Cloud and the lessons learned" https://nxdomain.no/~peter/hailmary_lessons_learned.html #ssh #keys #passwordgroping #unix #linux #openbsd #freebsd #pf #packetfilter #statetracking #blocklists #cybercrime #hacking

Also, The 4th edition of the Book of PF is coming soon: https://nxdomain.no/~peter/yes_the_book_of_pf_4th_ed_is_coming.html

The long version of why you need key authentication for your SSH servers - "The Hail Mary Cloud and the lessons learned" https://nxdomain.no/~peter/hailmary_lessons_learned.html #ssh #keys #passwordgroping #unix #linux #openbsd #freebsd #pf #packetfilter #statetracking #blocklists #cybercrime #hacking

Also, The 4th edition of the Book of PF is coming soon: https://nxdomain.no/~peter/yes_the_book_of_pf_4th_ed_is_coming.html

Happy "Logging in as users -, [ and $ day" to all who celebrate:

Jul 19 02:02:12 portal sshd-session[88959]: Failed password for invalid user - from 152.42.130.79 port 33738 ssh2
Jul 19 03:00:14 portal sshd-session[79691]: Failed password for invalid user [ from 152.42.130.79 port 41708 ssh2
Jul 19 03:58:56 portal sshd-session[6194]: Failed password for invalid user $ from 152.42.130.79 port 55398 ssh2

#ssh #passwordgroping #security #passwords #cybercrime #botnet

Happy "Logging in as users -, [ and $ day" to all who celebrate:

Jul 19 02:02:12 portal sshd-session[88959]: Failed password for invalid user - from 152.42.130.79 port 33738 ssh2
Jul 19 03:00:14 portal sshd-session[79691]: Failed password for invalid user [ from 152.42.130.79 port 41708 ssh2
Jul 19 03:58:56 portal sshd-session[6194]: Failed password for invalid user $ from 152.42.130.79 port 55398 ssh2

#ssh #passwordgroping #security #passwords #cybercrime #botnet

? hours left to vote:

I was recently contacted by somebody who claimed to have had their traffic blocked because one or more IP addresses in their range was in the "big list" of #pop3gropers mentioned in https://nxdomain.no/~peter/badness_enumerated_by_robots.html, with the entry dating to before they took over that particular range. That, my friends, is *not* the intended use (that's what the sixweeks list is for).

Also see https://nxdomain.no/~peter/should_i_stop_caring_and_let_ip_reputation_sort_them_out.html

#passwordgroping #cybercrime #ipreputation #honeypot

But what to do? Should I

? hours left to vote:

I was recently contacted by somebody who claimed to have had their traffic blocked because one or more IP addresses in their range was in the "big list" of #pop3gropers mentioned in https://nxdomain.no/~peter/badness_enumerated_by_robots.html, with the entry dating to before they took over that particular range. That, my friends, is *not* the intended use (that's what the sixweeks list is for).

Also see https://nxdomain.no/~peter/should_i_stop_caring_and_let_ip_reputation_sort_them_out.html

#passwordgroping #cybercrime #ipreputation #honeypot

But what to do? Should I

? hours left to vote:

I was recently contacted by somebody who claimed to have had their traffic blocked because one or more IP addresses in their range was in the "big list" of #pop3gropers mentioned in https://nxdomain.no/~peter/badness_enumerated_by_robots.html, with the entry dating to before they took over that particular range. That, my friends, is *not* the intended use (that's what the sixweeks list is for).

Also see https://nxdomain.no/~peter/should_i_stop_caring_and_let_ip_reputation_sort_them_out.html

#passwordgroping #cybercrime #ipreputation #honeypot

But what to do? Should I

? hours left to vote:

I was recently contacted by somebody who claimed to have had their traffic blocked because one or more IP addresses in their range was in the "big list" of #pop3gropers mentioned in https://nxdomain.no/~peter/badness_enumerated_by_robots.html, with the entry dating to before they took over that particular range. That, my friends, is *not* the intended use (that's what the sixweeks list is for).

Also see https://nxdomain.no/~peter/should_i_stop_caring_and_let_ip_reputation_sort_them_out.html

#passwordgroping #cybercrime #ipreputation #honeypot

But what to do? Should I

? hours left to vote:

I was recently contacted by somebody who claimed to have had their traffic blocked because one or more IP addresses in their range was in the "big list" of #pop3gropers mentioned in https://nxdomain.no/~peter/badness_enumerated_by_robots.html, with the entry dating to before they took over that particular range. That, my friends, is *not* the intended use (that's what the sixweeks list is for).

Also see https://nxdomain.no/~peter/should_i_stop_caring_and_let_ip_reputation_sort_them_out.html

#passwordgroping #cybercrime #ipreputation #honeypot

But what to do? Should I

I wonder what happened here:

May 29 05:19:33 portal sshd-session[12463]: Failed password for invalid user ^ from 196.251.89.193 port 38538 ssh2

no prizes, just puzzled

#ssh #passwordgroping #cybercrime #sshgropers

I wonder what happened here:

May 29 05:19:33 portal sshd-session[12463]: Failed password for invalid user ^ from 196.251.89.193 port 38538 ssh2

no prizes, just puzzled

#ssh #passwordgroping #cybercrime #sshgropers

"I have yet to meet an admin who plausibly claims to never have been tripped up by their overload rules at some point."

More, and a walk down memory lane, in "The Hail Mary Cloud And The Lessons Learned" https://nxdomain.no/~peter/hailmary_lessons_learned.html
#ssh #passwords #bruteforce #passwordgroping #cybercrime #openbsd #pf #packetfilter #security #guessablepasswords #hailmary #hailmarycloud

"I have yet to meet an admin who plausibly claims to never have been tripped up by their overload rules at some point."

More, and a walk down memory lane, in "The Hail Mary Cloud And The Lessons Learned" https://nxdomain.no/~peter/hailmary_lessons_learned.html
#ssh #passwords #bruteforce #passwordgroping #cybercrime #openbsd #pf #packetfilter #security #guessablepasswords #hailmary #hailmarycloud

So this happened:

Jan 30 03:07:16 skapet sshd-session[94311]: Failed password for invalid user "> from 165.231.182.56 port 15613 ssh2

I wonder if we are seeing a variant of "gropefor database down, feeding raw html to the ssh gropebot" scenario again such as in https://nxdomain.no/~peter/so_somebody_is_throwing_html_at_your_sshd.html #sshgropers #sshd #passwordguessing #passwordgroping #passwords #cybercrime

So this happened:

Jan 30 03:07:16 skapet sshd-session[94311]: Failed password for invalid user "> from 165.231.182.56 port 15613 ssh2

I wonder if we are seeing a variant of "gropefor database down, feeding raw html to the ssh gropebot" scenario again such as in https://nxdomain.no/~peter/so_somebody_is_throwing_html_at_your_sshd.html #sshgropers #sshd #passwordguessing #passwordgroping #passwords #cybercrime

More data points - today's is

Oct 6 02:03:53 skapet sshd-session[76897]: Failed password for invalid user Can't open ikk from 2a02:4780:10:42bf::1 port 43964 ssh2

More likely than not a variant of spamto database gone awol like back in the day https://nxdomain.no/~peter/so_somebody_is_throwing_html_at_your_sshd.html (prettified, tracked https://bsdly.blogspot.com/2016/12/so-somebody-is-throwing-html-at-your.html) but still hilarious

#sshgropers #passwordgroping #bruteforce #shitheadery #botnets #sillybuggers #cybercrime

More data points - today's is

Oct 6 02:03:53 skapet sshd-session[76897]: Failed password for invalid user Can't open ikk from 2a02:4780:10:42bf::1 port 43964 ssh2

More likely than not a variant of spamto database gone awol like back in the day https://nxdomain.no/~peter/so_somebody_is_throwing_html_at_your_sshd.html (prettified, tracked https://bsdly.blogspot.com/2016/12/so-somebody-is-throwing-html-at-your.html) but still hilarious

#sshgropers #passwordgroping #bruteforce #shitheadery #botnets #sillybuggers #cybercrime

Another data point in the "you thought you had seen it all, but no siree" set -

Oct 4 13:34:04 skapet sshd-session[38440]: Failed password for invalid user Can't open ica from 2001:df7:3c00:800a::446:34dc port 54770 ssh2

(and from several other locations)

#sshgropers #passwordgroping #bruteforce #shitheadery #botnets #sillybuggers

Another data point in the "you thought you had seen it all, but no siree" set -

Oct 4 13:34:04 skapet sshd-session[38440]: Failed password for invalid user Can't open ica from 2001:df7:3c00:800a::446:34dc port 54770 ssh2

(and from several other locations)

#sshgropers #passwordgroping #bruteforce #shitheadery #botnets #sillybuggers

[07/Feb/2024:18:09:02 +0100] "GET /manage/account/login HTTP/1.1" 301 162 "-" "'Cloud mapping experiment. Contact [email protected]'"

And certainly when you also throw binary junk at webservers and grope "login" URLs. #cybercrime #cyberstalking #passwordgroping #deliverability 2/2

[07/Feb/2024:18:09:02 +0100] "GET /manage/account/login HTTP/1.1" 301 162 "-" "'Cloud mapping experiment. Contact [email protected]'"

And certainly when you also throw binary junk at webservers and grope "login" URLs. #cybercrime #cyberstalking #passwordgroping #deliverability 2/2

I think this is what we call a 'Hail Mary pass' -

Jan 10 16:07:39 skapet sshd[71400]: Failed password for invalid user ***** from 116.110.116.188 port 58818 ssh2

#passwordgroping #passwordguessing #cybercrime #insecurity #security #ssh #morons #hailmary