Re: SSH probe attack afoot?

[Barrie Dempster <barrie () reboot-robot net>]

On Tue, 2005-02-08 at 18:25 +0000, Joe Egloff wrote:
> In-Reply-To: <42089361.1010203 () yahoo com sg>
>
> Matter of fact I did, but the amount of hosts is increasing. I'm currently assuming, that there some sort race going 
> on. Seems like one or more groups trying to "expand" their bot nets.
>
> Why bot nets? Well, on most of the systems I checked I found that the IRC ports are open or on other ports some IRC 
> alike service is running.

bots as part of botnets don't generally setup IRC servers on their
hosts. They instead connect to an existing IRC server and join a meeting
point channel to be controlled, with single commands. Slightly hard to
control them if they all live on separate servers and you have to
connect to each individually.
-- 
With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue

blog: http://zeedo.blogspot.com
site: http://www.bsrf.org.uk

[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]

Attachment: signature.asc
Description: This is a digitally signed message part