Exodus / Clue problems

Mon Nov 16 03:32:32 UTC 1998

We're seeing it at Vineyard.NET. We're getting volleys of 8 telnets with no
apparent username or password provided, roughly once every 9 minutes.
----- Original Message -----
From: Steve Gibbard <scg at wwnet.net>
To: <nanog at merit.edu>
Sent: Sunday, November 15, 1998 9:56 PM
Subject: Re: Exodus / Clue problems


>We're seeing it here too.  It appears to have started around 9:10 pm on
>one server, and around 9:20 pm on the other.
>
>-Steve
>
>On Sun, 15 Nov 1998, William S. Duncanson wrote:
>
>> Seeing it here, too.
>>
>> At 18:52 11/15/98 -0500, Daniel Senie wrote:
>> >sigma at pair.com wrote:
>> >>
>> >> Let me guess - the IP is 209.67.50.254, and they're trying to login to
>> >> nameservers as "root", sometimes a dozen times per second?
>> >
>> >I'm seeing that IP address trying to telnet into my name servers (don't
>> >know if it's as root, since my filters are blocking them). I also see
>> >them trying to access IMAP on my servers.
>> >
>> >Dan
>> >
>> >--
>> >-----------------------------------------------------------------
>> >Daniel Senie                                        dts at senie.com
>> >Amaranth Networks Inc.            http://www.amaranthnetworks.com
>>
>>
>> William S. Duncanson                      caesar at starkreality.com
>> The driving force behind the NC is the belief that the companies who
brought us
>> things like Unix, relational databases, and Windows can make an appliance
that
>> is inexpensive and easy to use if they choose to do that.  -- Scott Adams
>>
>
>--
>Steve Gibbard
>WWNet System Administration
>+1 734 513-7707 x 2009
>http://www.wwnet.net
>
>