Re: Port 109 scanning

[azimuth <lozah () io com>]

Howdy,

They're not necessarily looking to exploit POP2.  By developing a list of
systems running POP2, they can go back and look for something more tasty.
 A system running POP2 is one sign of an ill-configured & neglected Linux
box ... as is one listening to port 98 (linuxconf).  If you build a list
of systems running one of those services, chances are strong the systems
are running more commonly exploited services.
Much more profitable to use this technique than, say, scanning for every
FTP server in the world looking for vulnerable versions of WU-FTP.

my $.02,
cheers,
az