Re: SSH attacks - anyone else seen these?

[Jose Nazario <jose@xxxxxxxxxx>]

> > Oct 15 15:30:04 mysrv sshd[9563]: Bad protocol version
> > identification 'POST 
> > /unauthenticated//..%01/..%01/..%01/..%01/..%01/..%01/..
> > %01/..%01/..%01/..%01/..%01/..%01/..%01' from 59.106.20.158

as for this:

        http://isc.sans.org/diary.html?date=2007-01-17

that seems to match in part.

________
jose nazario, ph.d.                 http://monkey.org/~jose/