Date: Sat, 24 Feb 2001 02:52:03 +0200 From: Matthew West <mwest@uct.ac.za> To: Andre Goeree <abgoeree@uwnet.nl> Cc: chat@freebsd.org Subject: Re: When will script kiddies ever learn? Message-ID: <20010224025203.A97408@apotheosis.org.za> In-Reply-To: <20010224014042.A39092@mandark.attica.home>; from "Andre Goeree" on Sat, Feb 24, 2001 at 01:40:42AM References: <20010224014042.A39092@mandark.attica.home>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Feb 24, 2001 at 01:40:42AM +0100, Andre Goeree wrote: > Nice, look what happened while fetching ports: > > Feb 24 01:17:24 mandark /kernel: ipfw: 2200 Deny TCP 205.241.169.135:80 213.227.140.238:2049 in via tun0 > Feb 24 01:17:36 mandark last message repeated 4 times > > Script kiddies? Who else would be stupid enough to look for a nfs > server. Hrm, 205.241.169.135 resolves to ns2.davidv.net, which, if you point your browser to it, has quite a FreeBSD centric web page. Are you sure you weren't perhaps fetching port distfiles from there somewhere? Or just browsing the page? If you weren't, then you might want to drop the domain owner a note that his machine's being used to do scans. Judging by it's name, my money's on them having used a bind exploit to get in. I can't get an answer from the machine with "dig" though. -- mwest@uct.ac.za To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-chat" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010224025203.A97408>