Re: Strange log on Win2000

From: Jeff Cochran (jcochran.nospam@naplesgov.com)
Date: 12/31/02


From: jcochran.nospam@naplesgov.com (Jeff Cochran)
Date: Tue, 31 Dec 2002 12:58:03 GMT


>Someone on a NG I sometimes read and write to has posted this log:
>
>----- START LOG ----
>217.235.143.144, anonymous@on.the.net, 12/24/02, 18:28:22, MSFTPSVC3,
>TERRASERVER, 155.105.20.20, 0, 0, 0, 230, 0, [73]PASS,
>anonymous@on.the.net, -,
>217.235.143.144, anonymous@on.the.net, 12/24/02, 18:29:02, MSFTPSVC3,
>TERRASERVER, 155.105.20.20, 18306, 0, 0, 225, 0, [73]ABORT, -, -,
>217.235.143.144, anonymous@on.the.net, 12/24/02, 18:29:38, MSFTPSVC3,
>TERRASERVER, 155.105.20.20, 0, 0, 0, 550, 2, [73]sent, /tagged/by/opanoris/
>. in/.scanned/1 .by/~-=]opanoris[=-~/ .com/for/ . @MY@FXP@BOARD@/FiLLeD
>by/Spiderman/cd1/sm_a.sfv, -,
>----- END LOG ----
>
>I have the feeling it's a hacker's job... can you confirm my suspicion?

Yup. And thanks for posting the IP address, now I know where to get
good WaReZ and Pr0n...

Tell them to close their anonymous access to FTP, then have fun
clearing out the restricted file names.

Jeff