4 ms·

That would look the same as a random failed ssh login, which happens all the time. The connection isn't maintained past that point (unless the payload chooses t

That would look the same as a random failed ssh login, which happens all the time. The connection isn't maintained past that point (unless the payload chooses to do so).

gitfan86 3y ago
It would be similar but the payload is going to be abnormally large compared to other failed login attempts.
- saagarjha 3y ago
  Not if the attacker uses it just to gain an initial foothold and then extends their access through other means.