Re: Strange FTP logs lines....

[Stephanie Wright <swright@xxxxxxxxx>]

> it looks like someone is abusing your FTP server. Do you have 
> anonymous access enabled? The file "1mbtest.ptf" is used to test the 
> bandwidth of your server. Its also a trademark of people that use 
> anonymous access FTP servers to store ripped movies and pirate 
> software.

Right-ooh.

> > Hello...
> >
> > I have somes stranges log lines on FTP part of my W10 server...
> >
> > Do you know that???
> >
> >  normals FTP log lines---->
> > Wed Oct  3 01:17:12 2001 64 217.11.164.215 1048578 /incoming/1mbtest.ptf b _
> > i a Kgpuser@xxxxxxxx ftp 0 *


And another clue is the email address. Email addresses are sent by 
some FTP clients (browsers among others), when you log in anonymously 
via ftp. I some browsers, you can set it as a preference whether or 
not your email address is sent.

So, if you do have anonymous ftp turned on, why? Usually that's only 
for downloads unless you have things set up with a firewall so that 
only local users can upload.

> > Wed Oct  3 01:17:16 2001 1 217.11.164.215 2513 /incoming/space.asp a _ i a
> > Kgpuser@xxxxxxxx ftp 0 *
> > Wed Oct  3 01:18:25 2001 62 217.11.164.215 1048578 /incoming/1mbtest.ptf b _
> > i a Zgpuser@xxxxxxxx ftp 0 *
> > Wed Oct  3 01:18:31 2001 1 217.11.164.215 2513 /incoming/space.asp a _ i a
> > Zgpuser@xxxxxxxx ftp 0 *
> > <---- normals FTP log lines
> >
> > normals FTP log lines---->
> > Thu Oct  4 18:27:56 2001 60 217.136.40.200 1000000 /incoming/1000 b _ i a
> > mail@xxxxxxx ftp 0 *
> > Thu Oct  4 18:28:30 2001 17 217.136.40.200 1000000 /incoming/1000 b _ i a
> > mail@xxxxxxx ftp 0 *
> > Thu Oct  4 18:31:02 2001 101 217.136.40.200 1000000 /incoming/1000 b _ o a
> > mail@xxxxxxx ftp 0 *
> > <---- normals FTP log lines
> >
> >  normals FTP log lines---->
> > Sun Oct  7 11:52:19 2001 5 80.62.21.5 18432 /incoming/1mbtest.ptf b _ i a
> > Agpuser@xxxxxxxx ftp 0 *
> > <---- normals FTP log lines
> >
> >  normals FTP log lines---->
> > Mon Oct  8 23:27:46 2001 55 217.11.169.82 1048578 /incoming/1mbtest.ptf b _
> > i a Cgpuser@xxxxxxxx ftp 0 *
> > Mon Oct  8 23:28:01 2001 1 217.11.169.82 2513 /incoming/space.asp a _ i a
> > Cgpuser@xxxxxxxx ftp 0 *
> > Mon Oct  8 23:29:21 2001 75 217.11.169.82 1048578 /incoming/1mbtest.ptf b _
> > i a Sgpuser@xxxxxxxx ftp 0 *
> > Mon Oct  8 23:29:25 2001 1 217.11.169.82 2513 /incoming/space.asp a _ i a
> > Sgpuser@xxxxxxxx ftp 0 *
> > <---- normals FTP log lines
> >
> >  normals FTP log lines---->
> > Wed Oct 10 13:01:52 2001 76 195.146.232.110 1048578 /incoming/1mbtest.ptf b
> > _ i a Sgpuser@xxxxxxxx ftp 0 *
> > Wed Oct 10 13:03:01 2001 67 195.146.232.110 1048578 /incoming/1mbtest.ptf b
> > _ o a Sgpuser@xxxxxxxx ftp 0 *
> > Wed Oct 10 13:03:09 2001 1 195.146.232.110 2513 /incoming/space.asp a _ i a
> > Sgpuser@xxxxxxxx ftp 0 *
> > Wed Oct 10 18:09:23 2001 6 217.11.167.75 200000
> > /incoming/.temp/._Tagged/.______by/._manu59/.______for/.__French_team/0.2MB
> > b _ i a anonymous@xxxxxxxxxx ftp 0 *
> > <---- normals FTP log lines
> >
> >  normals FTP log lines---->
> > Fri Oct 12 06:20:04 2001 128 213.8.128.16 1048578 /incoming/1mbtest.ptf b _
> > i a guest@xxxxxxxx ftp 0 *
> > Fri Oct 12 06:20:13 2001 2 213.8.128.16 2513 /incoming/space.asp a _ i a
> > guest@xxxxxxxx ftp 0 *
> > Fri Oct 12 08:04:29 2001 1 217.83.141.192 1016 /incoming/1kbtest.ptf a _ i a
> > Ygpuser@xxxxxxxx ftp 0 *
> > Fri Oct 12 08:04:44 2001 1 217.83.141.192 2513 /incoming/space.asp a _ i a
> > Ygpuser@xxxxxxxx ftp 0 *
> > Sat Oct 13 23:52:13 2001 50 217.11.164.222 1048578 /incoming/1mbtest.ptf b _
> > i a Qgpuser@xxxxxxxx ftp 0 *
> > Sat Oct 13 23:52:17 2001 1 217.11.164.222 2513 /incoming/space.asp a _ i a
> > Qgpuser@xxxxxxxx ftp 0 *
> > Sat Oct 13 23:53:15 2001 53 217.11.164.222 1048578 /incoming/1mbtest.ptf b _
> > i a Pgpuser@xxxxxxxx ftp 0 *
> > Sat Oct 13 23:53:19 2001 1 217.11.164.222 2513 /incoming/space.asp a _ i a
> > Pgpuser@xxxxxxxx ftp 0 *
> >
> > I think it s somes stranges hack attacks, do you think so????
> >
> > Thanks boys...
> >
> > ---------                    ----------
> > Tenon Intersystems' webten Mailing List
> > To unsubscribe: send mailto://webten-request@xxxxxxxxxxxxxxx
> > with the body: unsubscribe
> > Find searchable Mailing List archives at:
> > http://listsearch.blueworld.com/webtensearch.lasso
>
>
> --
> Kurt Harvey                   510.713.9100
> IT Manager           kurt@xxxxxxxxxxxxxxxx
> Beeline Group         www.beelinegroup.com
>
> ---------                    ----------
> Tenon Intersystems' webten Mailing List
> To unsubscribe: send mailto://webten-request@xxxxxxxxxxxxxxx
> with the body: unsubscribe
> Find searchable Mailing List archives at:
> http://listsearch.blueworld.com/webtensearch.lasso

--
    Stephanie J. Wright

---------------------------------------------------------------------
Tenon Intersystems                                       805-963-6983
1123 Chapala Street                                 swright@xxxxxxxxx
Santa Barbara, CA 93101                          http://www.tenon.com
---------------------------------------------------------------------

---------                    ----------
Tenon Intersystems' webten Mailing List
To unsubscribe: send mailto://webten-request@xxxxxxxxxxxxxxx
with the body: unsubscribe
Find searchable Mailing List archives at:
http://listsearch.blueworld.com/webtensearch.lasso