This connects to screen 0 on 'desktop', with all data encrypted. As an added bonus, the name 'desktop' is resolved on the machine running the ssh daemon, so can even be a NATed or otherwise invisible address. The packets just kept coming, although the target systems themselves were not up. Scan came in conjunction with ICMP and scans for port 6000 during the same time period. Same source IP was responsible for similar activity earlier in the day.
Times are eastern.
We promised that we would send information to you through the Y2K window. Which is a bit significant in that no employees were working today. Not sure if you are interested in this scripter kiddie stuff, but appreciate your e-mail list and want to reciprocate. Will keep you updated if you like through out the night. Hadn't seen any for most of the day but, their back.