On Sun, 15 Nov 1998, William S. Duncanson wrote:
At 18:52 11/15/98 -0500, Daniel Senie wrote:
Let me guess - the IP is 209.67.50.254, and they're trying to login to nameservers as "root", sometimes a dozen times per second? I'm seeing that IP address trying to telnet into my name servers (don't know if it's as root, since my filters are blocking them). I also see
sigma@pair.com wrote: them trying to access IMAP on my servers. Seeing it here, too.
Seeing it here, on multiple machines, literally thousands of attempts: Nov 15 14:05:50 server in.telnetd[4054]: connect from 209.67.50.254 Nov 15 14:05:50 server imapd[4055]: connect from 209.67.50.254 Nov 15 15:05:40 ns in.telnetd[26483]: refused connect from 209.67.50.254 Nov 15 15:05:40 ns in.telnetd[26484]: refused connect from 209.67.50.254 Nov 15 14:17:08 trap imapd[2330]: connect from 209.67.50.254 Nov 15 14:17:09 trap in.telnetd[2328]: refused connect from root@209.67.50.254 -Dan