Re: SMTP probes

From: Christine Kronberg (Christine_Kronbergat_private)
Date: Mon Apr 07 2003 - 02:28:04 PDT

Next message: Jerome: "unknown rootkit found in the wild"

Previous message: Justin Coffi: "RE: Does anyone recognize the scanner that causes this pattern ?"
In reply to: Rich Puhek: "SMTP probes"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Fri, 4 Apr 2003, Rich Puhek wrote:
>
> Has anyone else noticed an upswing in port 25 probes over the last few days?
>
> I'm seeing fairly large quantities of connections to port 25 (on the
> order of one every several seconds) with no real SMTP transations
> (logged by sendmail as "... did not issue MAIL/XPN/VRFY/ETRN during
> connection to MTA")

  I don't see any increase. This kind of connnection comes by
  each couple of days.

> Perhaps somethings probing for servers vulnerable to the recent sendmail
> problems?

  Bannergrabbing seems possible.

  Cheers,


                                                         Chris.


-- 
GeNUA mbH




<b>
----------------------------------------------------------------------------
Is SPAM over-loading your e-mail server, disk space or bandwidth?
SurfControl E-Mail Filter is flexible, intelligent and policy-driven
protection.
http://www.securityfocus.com/SurfControl-incidents2
Download your free fully functional
trial, complete with 30-days of free technical support.
Stop SPAM before it stops you.
----------------------------------------------------------------------------
</b>

Next message: Jerome: "unknown rootkit found in the wild"
Previous message: Justin Coffi: "RE: Does anyone recognize the scanner that causes this pattern ?"
In reply to: Rich Puhek: "SMTP probes"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Apr 07 2003 - 15:45:18 PDT