Re: big increase in ftp scanning

[Greg Owen <gowen () SOFTLOCK COM>]

> i've seen a ton of ftp scans in the last week.

        I had three this weekend, one source in common with yours.

(212.83.90.123) cgmd90123.chello.nl
(24.28.122.195) cs28122-195.houston.rr.com
(202.107.222.172) (no PTR record)

        All appear to simply be traversing the tree and looking for writable
directories, rather than probing for compromise.

        This server has been running for just over a month and has had no
probes before this weekend.  Must be that time of the moon.
        
--
        gowen -- Greg Owen -- gowen () SoftLock com