Linode.com Forum

[Scottso]

Just a heads up. I'm getting ssh scans on some of my employer's systems (which are not linodes) from:

75.127.96.174 (li22-174.members.linode.com)

So if this is your linode and you are not doing this yourself, you have been hacked. In any event , you have been blocked from all systems under my control. You might want to look into this.


Jun 27 19:06:06 labgate sshd(pam_unix)[28033]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.127.96.174
Jun 27 19:06:08 labgate sshd[28028]: error: PAM: Authentication failure for illegal user alex from 75.127.96.174
Jun 27 19:06:08 labgate sshd[28028]: Failed keyboard-interactive/pam for invalid user alex from 75.127.96.174 port 58970 ssh2
Jun 27 19:06:08 labgate sshd[28035]: Invalid user alex from 75.127.96.174
Jun 27 19:06:08 labgate sshd(pam_unix)[28040]: check pass; user unknown
Jun 27 19:06:08 labgate sshd(pam_unix)[28040]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.127.96.174
Jun 27 19:06:10 labgate sshd[28035]: error: PAM: Authentication failure for illegal user alex from 75.127.96.174
Jun 27 19:06:10 labgate sshd[28035]: Failed keyboard-interactive/pam for invalid user alex from 75.127.96.174 port 59893 ssh2
Jun 27 19:06:11 labgate sshd[28041]: Invalid user alex from 75.127.96.174
Jun 27 19:06:11 labgate sshd(pam_unix)[28046]: check pass; user unknown

And so on.

[nepveul]

Hey Scottso, yeah, that was my linode, sorry for the inconvenience, it shut down until I can resolve the problem.