Security Incidents: Strange Scan

From: TJ Jablonowski <t.jablonowski_at_MAIL-2-GO.COM>
Date: Sun, 17 Dec 2000 09:36:53 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Found this one in some logs today. Ftp server running on port 21

[5] Sun 17Dec00 08:56:24 - (000042) Connected to 212.120.197.XXX
(Local address xxx.xxx.xxx.xxx)
[6] Sun 17Dec00 08:56:24 - (000042) 220 Serv-U FTP-Server v2.5i for
WinSock ready...
[2] Sun 17Dec00 08:56:24 - (000042) GET http://www.s3.com HTTP/1.1
[6] Sun 17Dec00 08:56:24 - (000042) 530 Not logged in.
[2] Sun 17Dec00 08:56:24 - (000042) Host: www.s3.com
[6] Sun 17Dec00 08:56:24 - (000042) 530 Not logged in.
[2] Sun 17Dec00 08:56:24 - (000042) Accept: */*
[6] Sun 17Dec00 08:56:24 - (000042) 530 Not logged in.
[2] Sun 17Dec00 08:56:24 - (000042) Pragma: no-cache
[6] Sun 17Dec00 08:56:24 - (000042) 530 Not logged in.
[2] Sun 17Dec00 08:56:24 - (000042) User-Agent: ProxyHunter
[6] Sun 17Dec00 08:56:25 - (000042) 331 User name okay, need
password.
[5] Sun 17Dec00 08:56:25 - (000042) IP-Name: PAT31.X-TREME.GR
[5] Sun 17Dec00 08:56:26 - (000042) Closing connection

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0

iQA/AwUBOjzPgm+7g8loOAk5EQKx7ACg5hbzxkxoJb4yW4TbdZi7iUQgEOwAnR8G
7nDSybhGwKZklgXXetwaZ33k
=cJ5o
-----END PGP SIGNATURE-----
Received on Dec 18 2000