[Dshield] Ssh Scans

Kelly Hamlin k.hamlin at t3com.com
Thu Mar 10 20:41:08 GMT 2005


Like previous writer mentioned, this is just a show as to what they are
trying now. Most of which are system accounts, and randam garble they think
will strike them the all-mighty root shell.

abc
access
account
adam
admin
admin-root
alan
alex
alpha
amanda
ana
anderson
andrea
andrew
angel
angela
apache
arthur
ashley
aspire
athos
backup
bank
barbara
ben
betty
billy
black
blake
blue
bob
bogdan
brandon
brian
brother
bruce
buddy
calvin
carmen
carole
cgi-bin
charles
charlie
chiliasp
chris
christi
christopher
cip51
cip52
connect
coolboy
cosmin
credit
cristi
cyndee
cyrus
daniel
darrel
data
dave
david
deamon
derek
dog
donna
edward
emily
eric
fax
fbi
finance
fire
firewall
frank
gabriel
gai
gay
george
god
green
guest
henry
home
honda
horde
horse
host
hosting
hunter
iceuser
info
irc
ircd
ircu
james
jane
jason
jeremy
jerry
jessica
jhanus
jhenderson
joe
john
johnny
johnson
jordan
joshua
just
justice
justin
kevin
larisa
laser
lesa
lion
lisa
liviu
local
louis
lucy
maggie
magic
mailtest
manager
maria
mario
mark
market
martin
master
matt
matthew
maverick
max
michael
michelle
mickey
mike
mitchell
nancy
nathan
nicholas
nicole
noc
nokia
office
oracle
pamela
patrick
paul
petter
phantom
phillip
postgres
project
pub
purchase
rebecca
red
reichard
richard
robert
robin
rolo
ron
root-admin
rose
router
rusty
sales
samantha
school
server
service
shadow
shannon
sharon
shell
shin
shop
slapme
smile
smith
snoopy
sonya
sparc
sparky
stefano
stephen
steven
student
stupid
sue
susan
sybase
system
tcp
test
thomas
tom
tony
tracy
tv
user
vampire
van
veronica
victor
victoria
vip
web
webb
webmaster
william
www
www-data
wwwrun
yellow
young
yoyo

-----Original Message-----
From: list-bounces at lists.dshield.org [mailto:list-bounces at lists.dshield.org]
On Behalf Of Joel Esler
Sent: Wednesday, March 09, 2005 7:35 PM
To: General DShield Discussion List
Subject: [Dshield] Ssh Scans

Haven't heard alot of Ssh scan discussion lately (probably because it's 
become about as often as 137 scans)..  but I thought I would throw out 
a list of attempts to my boxes.  Happy trails:

cat secure* | grep invalid | awk '{print $11}' | sort | uniq

account
adam
admin
alan
alex
ana
andrea
andrew
angel
backup
bank
barbara
ben
betty
billy
black
blue
bob
brandon
brian
buddy
carmen
charlie
christopher
cip51
cip52
connect
coolboy
cosmin
credit
cyrus
daniel
data
david
derek
dog
domainmaster
emily
eric
fbi
fire
frank
ftpoperator
ftpserver
gai
gay
george
god
green
guest
henry
horde
horse
host
iceuser
info
irc
james
jane
jason
jeremy
joe
john
johnny
jordan
just
justice
justin
larisa
laser
lion
lisa
local
lucy
magic
mailman
mailserver
man
manager
maria
mario
mark
market
martin
master
matt
matthew
max
michael
nathan
nicholas
nicole
noc
nokia
oracle
pamela
patrick
proxy
pub
red
robert
robin
rolo
rose
rpcstatd
server
shell
shin
slapme
smile
smith
sonya
sparc
squid
stephen
steven
sybase
sys
system
tcp
test
tom
tomcat
tomcat4
tony
tv
user
vampire
veronica
victor
vip
web
webadmin
webalizer
webdomain
webmail
webmaster
william
www
www-data
wwwrun
yellow
yoyo



Joel Esler
BASE Project Lead
http://secureideas.sourceforge.net

-------------- Sponsor Message ------------------------------------
SANS Intrusion Immersion Training: Orlando, FL, February 3-9th
http://www.sans.org/orlando05

_______________________________________________
send all posts to list at lists.dshield.org
To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list