We're seeing it here too. It appears to have started around 9:10 pm on one server, and around 9:20 pm on the other.

-Steve

On Sun, 15 Nov 1998, William S. Duncanson wrote:

...

Seeing it here, too.

At 18:52 11/15/98 -0500, Daniel Senie wrote:

...

sigma@pair.com wrote:

...

Let me guess - the IP is 209.67.50.254, and they're trying to login to nameservers as "root", sometimes a dozen times per second?

I'm seeing that IP address trying to telnet into my name servers (don't know if it's as root, since my filters are blocking them). I also see them trying to access IMAP on my servers.

Dan

-- ----------------------------------------------------------------- Daniel Senie dts@senie.com Amaranth Networks Inc. http://www.amaranthnetworks.com

William S. Duncanson caesar@starkreality.com The driving force behind the NC is the belief that the companies who brought us things like Unix, relational databases, and Windows can make an appliance

We're seeing it at Vineyard.NET. We're getting volleys of 8 telnets with no apparent username or password provided, roughly once every 9 minutes. ----- Original Message ----- From: Steve Gibbard <scg@wwnet.net> To: <nanog@merit.edu> Sent: Sunday, November 15, 1998 9:56 PM Subject: Re: Exodus / Clue problems that

...

is inexpensive and easy to use if they choose to do that. -- Scott Adams

-- Steve Gibbard WWNet System Administration +1 734 513-7707 x 2009 http://www.wwnet.net