Security Basics mailing list archives
re: Is this a scanner?
From: H C <keydet89 () yahoo com>
Date: Thu, 12 Dec 2002 11:14:25 -0800 (PST)
Back to the question: Does the log show a new
scanner at
work, or is it merely a browser with these values
set
for anonymous logins? If it were the latter, I don't
see
why it would have an email address as both the
username
and password.
Without more log entries, it's hard to tell. Yes, it *could* be a scanner (based on the time stamps, it looks pretty automated), but it *could* also be someone's browser. Why does it have an email address in both the username and password? Well, w/ all of the misconfigured machines out there, is it any wonder that some dude misconfigured his browser's anon-FTP entries? I read your "welcome" msg:
220 All connection attempts logged/reported. Anyone attempting to log in will be reported to their ISP.
Access illegal unless prior permission recieved from owner of FTP server.
Wow, you really are an aspiring BOfH! You're msg says that you will report *anyone* trying to log in, to their ISPs, regardless! So you're actually planning to take the time to report everyone who logs in, even legit users?! Wow! Yeah, I know you say your little blurb about "illegal" access, but that somes after your other message...sheesh, dude! You're hard core! __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com
Current thread:
- Is this a scanner? Pez Mohr (Dec 12)
- Re: Is this a scanner? Matti Haack (Dec 13)
- <Possible follow-ups>
- re: Is this a scanner? H C (Dec 13)