Re: [Snort-sigs] SSH Scans Slightly off topic but related.......

On Wed, 8 Sep 2004, Jeff Price wrote:

*snip*
> Where can I look to find out about these attacks, most of my systems have 
> seen this traffic? I haven't been able to find out if this is a worm or 
> somebody running a script on their system.

  From my experiences it's a script. If it gets a positive answer
  you see in most cases a login from a different location soon
  afterwards (there are exceptions, but only few). I had mostly
  scans from Korea and logins from Romania. Was quite interesting
  to watch these people.
  If you want to find out for yourself, set up a honeypot.

  Cheers,


                                                  Chris Kronberg.




-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM. 
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs