On Wed, 12 Dec 2001, Ascent - Compton, Richard wrote:
> I keep seeing attempted connections to ftp by various boxes in the same
> subnets. Could this be some sort of scan for vulnerable ftp servers?
> Something like a CodeRed ftp worm?
Most likely one of the scanners looking for open FTP servers to store the
latest warez.
Hugo.
--
All email send to me is bound to the rules described on my homepage.
hvdkooij@vanderkooij.org http://hvdkooij.xs4all.nl/
Don't meddle in the affairs of sysadmins,
for they are subtle and quick to anger.
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu Dec 13 2001 - 10:22:30 PST