httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Carrie Salazar <sala...@nature.berkeley.edu>
Subject RE: [users@httpd] Strange, Disconcerting Access Log Entries
Date Mon, 04 Nov 2002 05:05:48 GMT
> XXX.XXX.167.56:25 HTTP/1.0" 200 7811 "-" "-"
> XXX.XXX.160.11:25 HTTP/1.0" 200 63621 "-" "-"
> The IP:25 concerns me.  Notice too that the server status code is
> 200.

i've had a similar log entry before but fortunately didn't return
200. seems it is happening more and more.

somebody ran a portscanner and found your stmp port open&free.
though it is hard to tell that they just *found* it through
a portscanner program, or found it and sent some spam.
they probably did something like this:
telnet yourserver.com 25
mail from hacker
[your server could deny here or not]
mail to victim
mean message
.
quit

--
carrie

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message