how to react on ssh attacks?

[Victor Marquez]

On 10/24/05, Erik P. Olsen <erik at epo.dk> wrote:

>
> (S)he has probably just stolen the source to the IBM page.
>

I just opened the site by its IP and then clicked some of the links
link from the suposed IBM page. All the links that are on the left
column have the same IP as a "domain name" and when clicked display
information about IBM products.

I think this IP really is at an IBM server from IBM Italy. I am sure
you can fill a complain and they will be VERY happy to prosecute the
person using their infrastructure for hacking.

I also did a whois on the IP, the administrator of the IP Addresses
Range corresponding to it is: abuse at fastweb.it and they seem to be
cooperative. Place a complain with them

http://www.zoneedit.com/whois.html?zone=81.208.32.170
route:        81.208.0.0/18
descr:        Fastweb Networks block
origin:       AS12874
remarks:      4th block released to it.fastweb local registry.
mnt-by:       FASTWEB-MNT
remarks:      In case of improper use originating from our network,
remarks:      please mail customer or abuse at fastweb.it
source:       RIPE # Filtered

Saludos desde Mexico

Victor Marquez