Rgpusers

["Gene Gomez" <gegomez () tycoint com>]

Folks,
I've been tracking for the last few weeks what I think is a group of bad
guys probing my network from France and Belgium.  One really interesting
thing is that I continually find them attempting logons to my FTP sites as
Anonymous/Rgpuser () home com.
Looking for Rgpuser on Google, I find a LOT of intrusion logs with
Rgpuser () home com sent as the password...interestingly enough, THOSE are all
coming from France and Belgium, too.  :)
So...they're most likely all using the same tool.  Anyone have an idea what
tool is generating these login attempts?

Gene Gomez





-------------------------------------------------------
This sf.net email is sponsored by: Are you worried about 
your web server security? Click here for a FREE Thawte 
Apache SSL Guide and answer your Apache SSL security 
needs: http://www.gothawte.com/rd523.html
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users