Re: FTP scans from wanadoo.fr

From: loon (loon@loadedpenguin.com)
Date: 12/18/01 

From: loon <loon@loadedpenguin.com>
To: aaron@aaronwolfe.com
Date: 17 Dec 2001 17:22:16 -0600

Hello,
I'm sure you are all seeing this, but, i have noticed a bit of a pattern
to all this, every hit i get starts with the A....i.e.:

ftp connection attempt from AReims-101-1-4-54.abo.wanadoo.fr:3165
ftp connection attempt from AToulouse-201-1-2-235.abo.wanadoo.fr:2304
ftp connection attempt from ALyon-201-1-6-98.abo.wanadoo.fr:3620
ftp connection attempt from ABrest-101-1-4-4.abo.wanadoo.fr:3858
ftp connection attempt from ALagny-101-1-6-165.abo.wanadoo.fr:4526
ftp connection attempt from ALille-101-1-2-251.abo.wanadoo.fr:1025
ftp connection attempt from ABesancon-101-1-4-78.abo.wanadoo.fr:3884

this should all but confirm the fact that its some sort of script...hope
that helps...

loon

On Mon, 2001-12-17 at 11:59, Aaron Wolfe wrote:
>
> hello,
>
> for some time (weeks if not months) several of our remote offices have been
> logging connects attempts to port 21 from various ips that resolve to
> (something).wanadoo.fr. since we have firewalls on many different networks
> from several providers all logging these attempts, i'm fairly sure this is a
> script randomly scanning ips. I even put up an FTP server on one box to see
> what would happen if port 21 was open, it attempted to login as anonymous
> but I didn't let it go any further.
>

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Re: Configure ISA to allow ISA Server to make external FTP Connection
    ... > They know IP, protocol, direction and port. ... > allow the FTP connection but only to a particular domain? ... I am trying to configure ISA to allow the ISA Server itself to make ...
    (microsoft.public.isa.configuration)
  • Re: Configure ISA to allow ISA Server to make external FTP Connection
    ... They know IP, protocol, direction and port. ... allow the FTP connection but only to a particular domain? ... the FTP server should be making the data connections to your ISA ...
    (microsoft.public.isa.configuration)
  • ssh.com v3.2.9.1 slow performance with ftp over ssh port forwarding?
    ... i am using a ssh port forwarded tunnel to secure a ftp connection between 2 ... 210KByte/sec over the forwarded ftp connection. ... forwarding that improve performance? ...
    (comp.security.ssh)
  • Re: SFTP Limited Availability
    ... I made was for it to use port 21 instead of port 22, ... Network error: Connection reset by peer ... In order to handle it most firewalls need to inspect the content of the control channel in order to know what other ports a given FTP connection needs. ... I suspect that your firewall is inspecting the connection on port 21 and waiting for it to behave like an FTP connection and eventually gives up and kills the connection. ...
    (SSH)
  • Re: SFTP Limited Availability
    ... The paperwork is in for getting port 22 opened. ... On Nov 6, 2006, at 5:23 PM, Darren Tucker wrote: ... In order to handle it most firewalls need to inspect the content of the control channel in order to know what other ports a given FTP connection needs. ... I suspect that your firewall is inspecting the connection on port 21 and waiting for it to behave like an FTP connection and eventually gives up and kills the connection. ...
    (SSH)