RE: Internet SSH scans
"William Tarkington" <[email protected]>
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Message-ID | <5B30129FAC49284A849F0C20F9E92D5C01B07823@rwc-exch-prd1.myopwv.com> |
This appears to be related to a Romanian organized crime ring. They are using ssh scans + password lists for easy to guess servers. From there they create a phishing site. It has been on the rise for about 3 months or so from my records. --Will -----Original Message----- From: Tom Frerichs [mailto:[email protected]] Sent: Thursday, March 02, 2006 8:57 PM To: [email protected] Subject: RE: Internet SSH scans I'm seeing the same sorts of scans, but it seems to be only on hosts that offer web services and have publicly published URLs that might be found in a user's cache. Tom Frerichs - Denver