Greetings --
You'll have to pardon me if this particular site is well-known; I
haven't been following this list all that closely lately.
We got a probe on our anonymous FTP server for possible spamming
activity. The relevant log entries are:
Jan 30 02:59:06 ftp wu-ftpd[24583]: connect from root@spamshack.dav.mwci.net
Jan 30 03:00:14 ftp ftpd[24583]: refused PORT 0,113 from spamshack.dav.mwci.net
Jan 30 03:00:17 ftp ftpd[24583]: refused PORT 0,113 from spamshack.dav.mwci.net
Jan 30 03:00:19 ftp ftpd[24583]: refused PORT 0,113 from spamshack.dav.mwci.net
I'd guess that if the PORT command had been successful, ftp.mr.net
might be used for spamming activity at some later date using the FTP
port redirect technique.
-Scott
---
Scott Lystig Fritchie, Network Engineer MRNet Internet Services, Inc.
fritchie@mr.net, PGP key #152B8725 Minnesota Regional Network
v: 612/362.5820, p: 612/637.9547 2829 University Ave SE
http://www.mr.net/~fritchie/ Minneapolis, MN 55414
|
|
