Security Incidents mailing list archives

ProFTPD Scan?


From: Kurth Bemis <kurth () USAEXPRESS NET>
Date: Mon, 12 Mar 2001 12:28:42 -0500

I found these in todays logs - notice the times "15:32:13"  thats four hits
at the same time. and then two at a different time.  Looks like a DoS
attempt to (although i've been known to have been wrong).

In today's logs.

Mar 12 15:30:28 trinity proftpd[19132]: trinity
(AVelizy-101-1-2-117.abo.wanadoo.fr[193.253.200.117]) - USER ftp (Login
failed): Can't find user.
Mar 12 15:32:13 trinity proftpd[19147]: trinity
(AVelizy-101-1-2-117.abo.wanadoo.fr[193.253.200.117]) - USER ftp (Login
failed): Can't find user.
Mar 12 15:32:13 trinity proftpd[19148]: trinity
(AVelizy-101-1-2-117.abo.wanadoo.fr[193.253.200.117]) - USER ftp (Login
failed): Can't find user.
Mar 12 15:30:28 trinity proftpd[19132]: trinity
(AVelizy-101-1-2-117.abo.wanadoo.fr[193.253.200.117]) - USER ftp (Login
failed): Can't find user.
Mar 12 15:32:13 trinity proftpd[19147]: trinity
(AVelizy-101-1-2-117.abo.wanadoo.fr[193.253.200.117]) - USER ftp (Login
failed): Can't find user.
Mar 12 15:32:13 trinity proftpd[19148]: trinity
(AVelizy-101-1-2-117.abo.wanadoo.fr[193.253.200.117]) - USER ftp (Login
failed): Can't find user.

Can anyone provide insight?

~kurth


Current thread: