[tor-relays] Re: Update: Tor relays source IPs spoofed to mass-scan port 22

["littlehoster.denote399--- via tor-relays" <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

Hi, I had very similar reports to tor-operator_urdn.co:

DateTime Action AttackClass SourceIP Srcport Protocol DestinationIP DestPort

0 30-Oct-2024 14:06:13 BLOCKED attempted-recon 92.51.45.21 0 202.91.162.47 22

1 30-Oct-2024 14:43:35 BLOCKED attempted-recon 92.51.45.21 0 202.91.162.24 22

2 30-Oct-2024 15:11:40 BLOCKED attempted-recon 92.51.45.21 0 202.91.162.24 22

3 30-Oct-2024 15:19:05 DENIED 92.51.45.21 64006 TCP 202.91.162.172 22

4 30-Oct-2024 15:19:20 BLOCKED attempted-recon 92.51.45.21 0 202.91.162.24 22

5 30-Oct-2024 15:44:49 DENIED 92.51.45.21 18054 TCP 202.91.161.94 22

The report is from the same IP-range.

_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx