Looks like a script kiddie tried running an HTTP exploit over my SMTP port?
10/9 05:34:40p 3416 SMTP [69.5.169.203] Connection accepted on 192.168.1.7 po
rt 940 from port 14418
10/9 05:34:40p 3416 SMTP [69.5.169.203] Hostname: 69-5-169-203.infrawat.ch
10/9 05:34:41p 3416 SMTP DNSBL Query: 203.169.5.69.dnsbl-1.uceprotect.net r
esolved to: 127.0.0.2
10/9 05:34:41p 3416 SMTP [69.5.169.203] BLACKLISTED SERVER on dnsbl-1.ucepr
otect.net: 69-5-169-203.infrawat.ch = 127.0.0.2
10/9 05:34:41p 3416 SMTP [69.5.169.203] !MISSING 'HELO' command (Received:
'GET / HTTP/1.1')
10/9 05:34:41p 3416 SMTP [69.5.169.203] !MISSING 'HELO' command (Received:
'Host: 71.204.139.119')
10/9 05:34:41p 3416 SMTP [69.5.169.203] !MISSING 'HELO' command (Received:
'User-Agent: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)')
10/9 05:34:41p 3416 SMTP [69.5.169.203] !MISSING 'HELO' command (Received:
'Accept: */*')
10/9 05:34:41p 3416 SMTP [69.5.169.203] !MISSING 'HELO' command (Received:
'Accept-Encoding: gzip')
10/9 05:34:41p 3416 SMTP [69.5.169.203] !MISSING 'HELO' command (Received:
'Connection: close')
10/9 05:34:41p 3416 SMTP [69.5.169.203] !MISSING 'HELO' command (Received:
'')
10/9 05:34:41p 3416 SMTP Connection reset by peer on receive
---
■ Synchronet ■ .: realitycheckbbs.org :: scientia potentia est :.
|
