[nsp-sec] ACK AS209 / SSH scanning - we are now up over 1000

[Barry Raveendran Greene]

On 8/10/10 9:02 AM, "Donald Smith" <Donald.Smith at qwest.com> wrote:

> 
> Netflow shows that our ips identified by Joel are in fact scanning for tcp 22
> and based on the small size of the packets with the ack bit set they are
> attempting to bruteforce others ssh accounts too:(

Is there any way to get into the machines and get the malware, C&C, etc. ?