Exodus / Clue problems

Mon Nov 16 01:06:31 UTC 1998

On Sun, 15 Nov 1998, William S. Duncanson wrote:
> At 18:52 11/15/98 -0500, Daniel Senie wrote:
> >sigma at pair.com wrote:
> >> Let me guess - the IP is 209.67.50.254, and they're trying to login to
> >> nameservers as "root", sometimes a dozen times per second?
> >I'm seeing that IP address trying to telnet into my name servers (don't
> >know if it's as root, since my filters are blocking them). I also see
> >them trying to access IMAP on my servers.
> Seeing it here, too.

Seeing it here, on multiple machines, literally thousands of attempts:

Nov 15 14:05:50 server in.telnetd[4054]: connect from 209.67.50.254
Nov 15 14:05:50 server imapd[4055]: connect from 209.67.50.254

Nov 15 15:05:40 ns in.telnetd[26483]: refused connect from 209.67.50.254
Nov 15 15:05:40 ns in.telnetd[26484]: refused connect from 209.67.50.254

Nov 15 14:17:08 trap imapd[2330]: connect from 209.67.50.254
Nov 15 14:17:09 trap in.telnetd[2328]: refused connect from root at 209.67.50.254

-Dan