Is this a hack attempt?

[Newposter]

And were they successful?

This appears when I start my FTP server now (never did before):

Using registered version (Registration key passed)
[7] Wed 05Jun02 20:42:05 - Sock ID=2 socket(PF_INET,SOCK_STREAM,0) --> 124 (OK)
[7] Wed 05Jun02 20:42:05 - Sock ID=2 htonl(0x0) --> 0x0
[7] Wed 05Jun02 20:42:05 - Sock ID=2 htons(0x15) --> 0x1500
[7] Wed 05Jun02 20:42:07 - Sock ID=2 bind(124,0x0006F2A0,16) --> 0 (OK)
[7] Wed 05Jun02 20:42:07 - Sock ID=2 ioctlsocket(124,FIONBIO,0x0006F2C4) --> 0 (OK)
[7] Wed 05Jun02 20:42:07 - Sock ID=2 WSAAsyncSelect(124,196800,1024,FD_ACCEPT FD_CLOSE) --> 0 (OK)
[7] Wed 05Jun02 20:42:07 - Sock ID=2 listen(124,50) --> 0 (OK)
[7] Wed 05Jun02 20:42:07 - Sock ID=2 socket(PF_INET,SOCK_DGRAM,0) --> 144 (OK)
[7] Wed 05Jun02 20:42:07 - Sock ID=2 closesocket(144) --> 0 (OK)
[7] Wed 05Jun02 20:42:14 - Sock ID=2 gethostname(ralkml,99) --> 0 (OK)
[7] Wed 05Jun02 20:42:14 - Sock ID=2 gethostbyname(ralkml) --> 0x0007E898 (OK)

It also seems to be polling every 3 minutes. I have security set *very tight* for the server, but it started doing this today for the first time in the 6 months that I've been running this program. Newposter
"Good judgment comes from experience. Experience comes from bad judgment."

 

[sleipnir214]

What FTP server are you running? And at what logging level?

 

[Newposter]

It's Serv-U 2.5, and I did recently set it to log everything possible, to catch potential hackers. I turned off the debugging logs and it seems to have stopped. Thanks.

I get 5-10 hack attempts per day between FTP and web servers, so I get a little paranoid about security. Newposter
"Good judgment comes from experience. Experience comes from bad judgment."