New mail scanner?

From: Jeff Kell (jeff-kell_at_utc.edu)
Date: 08/09/03

  • Next message: Roberts, Chris: "RE: port 445 probes continued" 
    Date: Sat, 09 Aug 2003 02:10:36 -0400
To: Incidents <incidents@securityfocus.com>

    For the last couple of days we have been continually probed for SMTP
    services from several addresses, but the unique part of the scanning is
    that the source port is always zero. e.g.,

    > Aug 9 00:25:24.502 EDT: %SEC-6-IPACCESSLOGP: list ingress denied tcp 171.75.197.194(0) -> xxx.xxx.xxx.68(25), 1 packet
    > Aug 9 00:32:27.606 EDT: %SEC-6-IPACCESSLOGP: list ingress denied tcp 67.64.156.215(0) -> xxx.xxx.xxx.121(25), 1 packet

    (Actual sources)

    Anyone else seeing this? I don't have a honeypot to capture what they
    are looking for, but it doesn't look encouraging.

    Jeff

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: Roberts, Chris: "RE: port 445 probes continued"

    Relevant Pages

    • Re: SMTP and tcp ports
      ... I found that I needed smtp ACEs ... This ACE would not match clients (source port>1023). ... This ACE currently matches clients. ... A Cisco switch initiates an NTP connection to an NTP server on the router: ...
      (comp.dcom.sys.cisco)
    • Re: Mail Stuck in Queue - No errors
      ... Of course everyone has AV scanning these directories once ... What does that have to do with sending an smtp ... >> moved to the queue folder. ... >> mail server as a smarthost. ...
      (microsoft.public.inetserver.iis.smtp_nntp)
    • Re: SMTP and tcp ports
      ... I found that I needed smtp ACEs ... This ACE would not match clients (source port>1023). ... This ACE currently matches clients. ... A Cisco switch initiates an NTP connection to an NTP server on the router: ...
      (comp.dcom.sys.cisco)
    • Re: IMAP server to fit this bill?
      ... > Maybe you need no re-think the requirement to scan at SMTP time. ... but statistical scanning is so much more powerful than ... It introduces statistics which are meaningless in the ...
      (Debian-User)
    • Re: SMTP and tcp ports
      ... I found that I needed smtp ACEs ... This ACE would not match clients (source port>1023). ... A Cisco switch initiates an NTP connection to an NTP server on the router: ...
      (comp.dcom.sys.cisco)