Thomas Wheeler said: > Yip, seen it increase since this German "SPAM" started to hit my server > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Ken Jones > Sent: 18 May 2005 04:42 PM > To: ClamAV users ML > Subject: Re: [Clamav-users] Sober.P sidebar topic > > On Tuesday 17 May 2005 8:58 pm, Dennis Peterson wrote: >> Anyone noticing any increase in failed login attempts via ssh? I have >> and >> the timing associates well with the recent outbreak. > > Last night we saw the first password ssh scans against our machine. > Looks like scanning for default accounts with passwords set to "password" > > Ken Jones > inter7.com
We had one IP attempting to get in for quite a while (194.55.159.7) last night. Probably not worth blocking in the packet filter. If a pattern shows up I'll consider blocking IP ranges. dp _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
