🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: demon.security
Article #118

Re: Demon SMTP probes

#118
From: Stefan Davids
Date: Sat, 01 Apr 2000 00:00
37 lines
2078 bytes
>>>>> "Mark" == Mark Hughes <mark@compware.co.uk> wrote:

Mark> I've recently installed a nifty personal firewall and it is
Mark> showing me that demon is looking for a service on port 25
Mark> (SMTP). Two machines probe my machine periodically while I am
Mark> dialed in, and curiously they probe from apparently random
Mark> source ports. 

Let me guess every 10 minutes, or there abouts?

Mark> See below for some sample probes....

Mark> 194.217.242.6 (punt-21 mail.demon.net) port 59652 to port 25
Mark> 194.217.242.34 (punt-11 mail.demon.net) port 44003 to port 25

[...]

Mark> I don't wish demon to probe my machine for TCP/IP services.

They're trying to send you mail by smtp in the normal way by
connecting to your computer's smtp port.  Presumably you collect mail
by POP3 instead?

It's nothing to worry about at all, but you can turn smtp delivery off
somewhere on Demon's website (same place you can set a POP3 passwd and
other account related stuff IIRC).

Mark> Please copy replies to mark@agilic.com

Done.

Stefan

-- 
#!/usr/local/bin/perl -w  smd@hopf.demon.co.uk smd@maths.nott.ac.uk
open 0;$_=q(%sopen 0;$_=%c%c%s%c;printf $_,scalar <0>,113,40,$_,41;
);printf $_,scalar <0>,113,40,$_,41;
Technical Details
Message-ID: <m3pus9u3bn.meow@ory.hopf.demon.co.uk>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <954609562.14748.0.nnrp-13.9e98ed62@news.demon.co.uk>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1065b6,fefb3eeb89e1f549
X-Google-Attributes: gid1065b6,public
From: Stefan Davids <smd@hopf.demon.co.uk>
Subject: Re: Demon SMTP probes
Date: 2000/04/01
Message-ID: <m3pus9u3bn.meow@ory.hopf.demon.co.uk>
X-Deja-AN: 605326013
References: <954609562.14748.0.nnrp-13.9e98ed62@news.demon.co.uk>
X-GPG: http://www.hopf.demon.co.uk/smd-gpg.asc
Mail-Copies-To: never
To: mark@agilic.com
Content-Type: text/plain; charset=us-ascii
X-Trombone: Creole
X-Complaints-To: Someone who cares
Organization: St. James Infirmary
X-URL: http://www.hopf.demon.co.uk
X-Attribution: SMD
User-Agent: Gnus/5.0803 (Gnus v5.8.3) Emacs/20.4
Mime-Version: 1.0
Cancel-Lock: sha1:ywJeeRfK6Ppn0qbIJY3Gi2Hifro=
NNTP-Posting-Date: 1 Apr 2000 17:41:00 GMT
Newsgroups: demon.security