Hi Dave -- How were you able to determine this? The only thing that looks strange to my untrained eye is the following entries in my logs:
20020426 012830 127.0.0.1 SMTPD (14EC00C6) [216.0.153.77] connect 216.0.153.77 port 4702 20020426 012941 127.0.0.1 SMTPD (150F00C6) [216.0.153.77] connect 216.0.153.77 port 4707 20020426 013042 127.0.0.1 SMTPD (152D00C6) [216.0.153.77] connect 216.0.153.77 port 4712 20020426 013153 127.0.0.1 SMTPD (154F00C6) [216.0.153.77] connect 216.0.153.77 port 4717 20020426 013254 127.0.0.1 SMTPD (156E00C6) [216.0.153.77] connect 216.0.153.77 port 4722 20020426 013405 127.0.0.1 SMTPD (159000C6) [216.0.153.77] connect 216.0.153.77 port 4729 20020426 013506 127.0.0.1 SMTPD (15AE00C6) [216.0.153.77] connect 216.0.153.77 port 4734 20020426 013617 127.0.0.1 SMTPD (15D100C6) [216.0.153.77] connect 216.0.153.77 port 4739 20020426 013718 127.0.0.1 SMTPD (15EF00C6) [216.0.153.77] connect 216.0.153.77 port 4744 20020426 013829 127.0.0.1 SMTPD (161200C6) [216.0.153.77] connect 216.0.153.77 port 4749 20020426 013930 127.0.0.1 SMTPD (163000C6) [216.0.153.77] connect 216.0.153.77 port 4754 20020426 014030 127.0.0.1 SMTPD (18B500C4) [216.0.153.77] connect 216.0.153.77 port 4759 20020426 014131 127.0.0.1 SMTPD (166A00C6) [216.0.153.77] connect 216.0.153.77 port 4764 20020426 014231 127.0.0.1 SMTPD (168800C6) [216.0.153.77] connect 216.0.153.77 port 4769 None of these are connected with any sessions, at least as far as I can tell. Is this "normal?" Thanks! At 11:43 AM 4/26/2002 -0400, you wrote: > > -----Original Message----- > > From: Ted Sorrells [mailto:[EMAIL PROTECTED]] > > > Over the last 24 hours, I've had two servers fail to answer on port > > 80. > >I'm tearing my hair out on the same issue. > >Looks like a DoS involving 147.237.72.91 - www.info.gov.il, but that could >be spoofed. > >Web messaging works on 8383, and IIS on new IP addresses works on 80, so >they probably did a scan a while ago and are now targeting what they found. Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
