Security Incidents mailing list archives

Re: SSH probe attack afoot?


From: Joe Egloff <joe.egloff () franke com>
Date: 8 Feb 2005 18:25:06 -0000

In-Reply-To: <42089361.1010203 () yahoo com sg>

Matter of fact I did, but the amount of hosts is increasing. I'm currently assuming, that there some sort race going 
on. Seems like one or more groups trying to "expand" their bot nets.

Why bot nets? Well, on most of the systems I checked I found that the IRC ports are open or on other ports some IRC 
alike service is running.

Just curious here, after finding out where the IP >addresses come from, do you go ahead and send a abuse >complains to 
each one of them?


Current thread: