Re: [tlug] ssh scans

[ayako kato <ayako.kato@example.com>]

On 4 Jul 2002, Stephen J. Turnbull wrote:

> >>>>> "Matt" == Matt Doughty <mdoughty@example.com> writes:
> 
>     Matt> Anyone else seeing these now?
> 
> No.  :-)  I've been seeing them for many months, usually 2--3 times a



I've been seeing very few recently too.  There was a noticable increase
back when the weakness with protocol v1 was disclosed, but even that
didn't compare to the # of ftp scans. 

The popular target services are (and have been):

ftp
sunrpc
nb-something (netbios stuff)
telnet
http
ntp
dtspc (CDE stuff)