[Dshield] error log entries every 15 minutes

Mark Challender MarkC at mtbaker.wednet.edu
Thu Jun 13 19:02:20 GMT 2002


25 is smtp
119 is nntp
1080 is socks
6588 is analogX Web Proxy

It looks like the are trying to find servers.

Mark Challender
Network Administrator

=========
Why?
=========


-----Original Message-----
From: TranceDylan [mailto:trancedylan at blueyonder.co.uk]
Sent: Thursday, June 13, 2002 10:41 AM
To: list at dshield.org
Subject: Re: [Dshield] error log entries every 15 minutes


My ISP (Blueyonder broadband, UK) has recently installed a scanner.
ZoneAlarm is picking up a series of hits from it every 45mins probing ports
25, 119, 1080 and 6588 (6 times each).
I have spoken to a 'techie' at the ISP and they claim they are trying to
trap users infected with various trojans and mass-mailers.
Dyl

----- Original Message -----
From: "Frank Rizzo" <frankrizzocalled at hotmail.com>
To: <list at dshield.org>
Sent: Wednesday, June 12, 2002 2:43 PM
Subject: [Dshield] error log entries every 15 minutes


> Can anyone identify what this is all about? It appears every 15 minutes
and
> has done so for a few weeks.
>
> 213.253.xx.xx - - [02/Jun/2002:05:57:24 +0100] "GET / HTTP/1.0" 200 4110
"-"
> "check_http/1.32.2.6 (netsaint-plugins 1.2.9-4)"
>
> I dont know if its a genuine link checker or site exists validator but
every
> 15 minutes seems excessive to do that kind of checking.
>
> I have emailed the ISP but they havent got back yet.
>
>
>
> _________________________________________________________________
> Send and receive Hotmail on your mobile device: http://mobile.msn.com
>
>
>
>

_______________________________________________
Dshield mailing list
Dshield at dshield.org
To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list