[kwlug-disc] Identify this exploit?

[Ron Singh]

>From a non-techy/new-ish to Linux guy's perspectrive, what do I take away
from this bit of "follow the bouncing ball"?

    153.126.166.203 (ik1-319-19699.vs.sakura.ne.jp)

gives me this:
________________________________________________________________
Welcome to nmp3000's site

yukkuri goran kudasai
________________________________________________________________

and googling nmp3000, I get this twitter user as a top hit and he seems to
be a Linux-y kind of guy in Japan:

https://twitter.com/nmp3000

No idea if there is any meaning to be gleaned from this, but I thought it
might be mildly interesting. I do wonder if that fella's site is hacked and
someone is using his url for dastardly deeds. I am not at all savvy about
how these things work, but I thought it curious.

Thanks,

Ron Singh



On Sun, Dec 29, 2019 at 12:06 PM Khalid Baheyeldin <kb at 2bits.com> wrote:

> Here is an example from the scary internet ...
>
> From today's logs of a server I manage (via logwatch):
>
>  Failed logins from:
>     92.246.17.5: 1 time
>     95.88.219.197 (ip5f58dbc5.dynamic.kabel-deutschland.de): 1 time
>     153.126.166.203 (ik1-319-19699.vs.sakura.ne.jp): 1 time
>
>  Illegal users from:
>     undef: 3 times
>     12.22.203.226: 1 time
>     63.142.97.181 (63-142-97-63-142-97-181.cpe.sparklight.net): 1 time
>     92.246.17.5: 2 times
>     97.84.76.88 (97-84-76-88.dhcp.snlo.ca.charter.com): 1 time
>     115.160.163.195: 2 times
>     142.4.208.131 (ns502558.ip-142-4-208.net): 1 time
>     153.126.141.19 (ik1-306-13265.vs.sakura.ne.jp): 1 time
>
> These are all ssh login attempts from various IP addresses.
>
> _______________________________________________
> kwlug-disc mailing list
> kwlug-disc at kwlug.org
> http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://kwlug.org/pipermail/kwlug-disc_kwlug.org/attachments/20191229/c2280115/attachment.htm>