From owner-freebsd-security Fri Jan 7 6:20:17 2000 Delivered-To: freebsd-security@freebsd.org Received: from povray.org (netplex.aussie.org [204.213.191.226]) by hub.freebsd.org (Postfix) with ESMTP id 412B115758 for ; Fri, 7 Jan 2000 06:20:13 -0800 (PST) (envelope-from casonc@netplex.aussie.org) Received: from frankenputer (frankenputer [203.29.75.73]) by povray.org (8.9.3/8.9.3) with SMTP id JAA75362 for ; Fri, 7 Jan 2000 09:20:08 -0500 (EST) (envelope-from casonc@netplex.aussie.org) Message-Id: <200001071420.JAA75362@povray.org> From: "Chris Cason [work]" To: "freebsd-security@FreeBSD.ORG" Date: Sat, 08 Jan 2000 01:19:17 +1100 Reply-To: "Chris Cason [work]" X-Mailer: PMMail 98 Standard (2.01.1600) For Windows NT (4.0.1381;4) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: Re: Port scans and site theft from IP inside mr.net Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Thanks all for your assistance. We've been able to confirm that the telnet prompt that the box gives is from Netware (I never expected to see someone port-scanning and site-sucking from a netware box). And no-one can see the HTTP server anymore, so I presume he's taken that down. Oh, and apologies for posting earlier on using a winblows character set ; I was at work at the time and I'm a bit unfamiliar with Outlook Express :( -- Chris To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message