Are you logged on to msn messenger or logged into the hotmail service on any machine? I'm not sure if messenger uses port 25 for anything or not (believe it does), but I know it does use non-standard ports as well. I'd find it hard to believe it's trojaned and snooping you but then again it's M$ so who really knows what's going on there ;-) ----- Original Message ----- From: "Joshua b. Jore" <josh at greentechnologist.org> To: <tclug-list at mn-linux.org> Sent: Wednesday, August 22, 2001 8:03 PM Subject: [TCLUG] hotmail servers scanning... > Just a general issue, I've noticed a few IPs from the hotmail.com IP range > doing some curious scanning. The same IP will try several times to connect to > a specific high port and it's always sourced from the smtp port. > > I'm including a grep from my firewall log where it shows the hotmail IP, the > source port, the destination port (where I blocked the access) and how many > times the hotmail IP tried. So what's going on? Is hotmail trojaned or > something? Am I just missing something important here? > > 64.4.55.73 25 8546 6 > 64.4.55.171 25 10273 6 > 64.4.42.33 25 18839 11 > 64.4.49.144 25 44093 11 > 64.4.56.229 25 42600 7 > 64.4.56.203 25 11097 6 > 64.4.56.176 25 21336 5 > 64.4.55.20 25 40832 10 > 64.4.55.155 25 47103 11 > 64.4.42.30 25 29489 11 > 64.4.50.13 25 48844 11 > 64.4.56.226 25 23369 6 > > Joshua Jore > Minneapolis Ward 3, precinct 10 > "The irony of this man being imprisoned in the United States and longing > to return to once-Communist Russia so he can regain his right to free > speech is simply staggering." - someone else > > _______________________________________________ > tclug-list mailing list > tclug-list at mn-linux.org > https://mailman.mn-linux.org/mailman/listinfo/tclug-list >