5
votes
4answers
314 views

History of IP addresses that accesed a server via ssh

It has come to my attention that a server of mine has been hacked and infected with a known chinese botnet. It was a prototype/testing virtual machine with its own static IP(US address) so no harm ...
5
votes
2answers
2k views

How to find the cause of an ssh-scan exploit?

One customer emailed my about their provider about to shut down a server because ssh attacks. I logged in to the server and found a lot of ssh-scan processes, and some strange files in /tmp. I had ...