RE: [cobalt-users] lame servers at sun.com

["Peter Masloch" <peter@xxxxxxxxxxx>]

Looks like a port scan with probing for anonymous ftp login.
Peter


> > No comment necessary
> >
> > Unusual System Events
> > =-=-=-=-=-=-=-=-=-=-=
> > Jul 24 23:01:41 fsn4 named[11398]: Lame server on
> > '23.201.40.12.in-addr.arpa' (in '201.40.12.in-addr.arpa'?):
> > [192.18.99.5].53 'ns-brm.sun.com'
> > Jul 24 23:01:41 fsn4 named[11398]: Lame server on
> > '23.201.40.12.in-addr.arpa' (in '201.40.12.in-addr.arpa'?):
> > [192.9.9.3].53 'ns.sun.com'
> >
> >
> I had same at about that time and also from ns1.cobalt.net 
> and several since
> and also this one.
> 
> Jul 24 07:15:48 www proftpd[14177]: 65.70.90.26
> (39.190.62.62.9massy1-1-ro-bas-1.9tel.net[62.62.19
> 0.39]) - FTP session opened.
> Jul 24 07:15:48 www proftpd[14177]: 65.70.90.26
> (39.190.62.62.9massy1-1-ro-bas-1.9tel.net[62.62.19
> 0.39]) - FTP session closed.
> 
> and this one.
> 
> Jul 24 13:59:49 www proftpd[31354]: 65.70.90.26
> (255.194.33.65.cfl.rr.com[65.33.194.255]) - FTP se
> ssion opened.
> Jul 24 13:59:49 www proftpd[31354]: 65.70.90.26
> (255.194.33.65.cfl.rr.com[65.33.194.255]) - FTP se
> ssion closed.
> 
> I also noticed an increase in Lame servers, but what concerns 
> me is the
> proftp logins. I have no idea who these people are, they sure 
> as heck don't
> belong to my server.
> 
> Any ideas on that?
> 
> 
> 
> _____________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
> 
>