Security Incidents mailing list archives

Re: SSH probe attack afoot?


From: j lake <jlake () knoxcounty midcoast com>
Date: Tue, 8 Feb 2005 07:37:10 -0500

On Sunday 06 February 2005 10:09 am, Bernie Cosell wrote:
 I was
wondering: is there some virus or the like floating around now that
leaves an ssh-hammering zombie in its wake?  Or is it just coincidental
that we have gotten three floods?
I've been getting these for at least 6 months. back last Fall
there was some input on the list about this topic which helped 
me a great deal... I think it is a fairly
well-known bot with easy-to-modify source so it can scan for a variety of
usernames like www-user, cyrus, and even frodo and bogomir (get a life!)
~jl


Current thread: