[105392] in North American Network Operators' Group
Re: Intrustion attempts from Amazon EC2 IPs
daemon@ATHENA.MIT.EDU (Suresh Ramasubramanian)
Sun Jun 22 09:28:52 2008
Date: Sun, 22 Jun 2008 06:28:16 -0700
From: ops.lists@gmail.com (Suresh Ramasubramanian)
To: paul@blacknight.com, nanog@merit.edu
In-Reply-To: <D175CB0A04FE634587DA0987F3C423101ECFC1E1D7@iddawg.blacknight.local>
Errors-To: nanog-bounces@nanog.org
Well, there's spam originating from there, and some cracked scripts generating
part of it. So ok, someone's found that it makes a handy platform for ssh port
probes and such as well.
srs
"Paul Kelly :: Blacknight" <paul@blacknight.com> wrote:
> Hi there,
>
> Have any of you recently noticed a lot of ssh scanning coming from amazons EC
> "cloud" IP blocks?
>
> Today alone I've seen approx 4m attempts from EC2 IPs on just 20 nodes on our
> network.
>
> Has anyone any experience with Amazons abuse people?
>
> Thanks,
>
> Paul
