Snort mailing list archives
RE: Rgpusers
From: "Hawrylkiw, Dan G" <dan.g.hawrylkiw () intel com>
Date: Wed, 13 Nov 2002 08:55:17 -0800
The tool is called Grim's Ping It looks for anonymous writeable directories- likely to be used for warez sites. The author calls it "spreading the wealth"... http://grimsping.cjb.net/ /Dan Hawrylkiw, CISSP, GCIA, RHCE Do, or do not. There is no try. -Yoda -----Original Message----- From: Gene Gomez [mailto:gegomez () tycoint com] Sent: Wednesday, November 13, 2002 9:17 AM To: Snort-Users Subject: [Snort-users] Rgpusers Folks, I've been tracking for the last few weeks what I think is a group of bad guys probing my network from France and Belgium. One really interesting thing is that I continually find them attempting logons to my FTP sites as Anonymous/Rgpuser () home com. Looking for Rgpuser on Google, I find a LOT of intrusion logs with Rgpuser () home com sent as the password...interestingly enough, THOSE are all coming from France and Belgium, too. :) So...they're most likely all using the same tool. Anyone have an idea what tool is generating these login attempts? Gene Gomez ------------------------------------------------------- This sf.net email is sponsored by: Are you worried about your web server security? Click here for a FREE Thawte Apache SSL Guide and answer your Apache SSL security needs: http://www.gothawte.com/rd523.html _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This sf.net email is sponsored by: Are you worried about your web server security? Click here for a FREE Thawte Apache SSL Guide and answer your Apache SSL security needs: http://www.gothawte.com/rd523.html _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Rgpusers Gene Gomez (Nov 13)
- <Possible follow-ups>
- RE: Rgpusers Hawrylkiw, Dan G (Nov 13)