<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 02/18/2018 12:29 PM, DM Smith wrote:<br>
</div>
<blockquote type="cite"
cite="mid:B4CD498D-3F30-4578-AE2E-ED0901F8C1FA@crosswire.org">
<div class=""><a href="http://mail.crosswire.org" class=""
moz-do-not-send="true">mail.crosswire.org</a> is an alias for
<a href="http://www.crosswire.org" class=""
moz-do-not-send="true">www.crosswire.org</a> and <a
href="http://crosswire.org" class="" moz-do-not-send="true">crosswire.org</a>.
It may have nothing to do with mail.</div>
</blockquote>
Oh, to be sure, I don't think the question is mail-related, and I
knew of the alias -vs- real name relationship. I'm just wondering
what crosswire.org thought it was doing by sending superlatively
random connection requests at oh-dark-thirty.<br>
<br>
The fact that the host reached is the current <a class="moz-txt-link-abbreviated" href="ftp://ftp.xiphos.org">ftp.xiphos.org</a> is
likely complete coincidence, and of course my firewall log shows
hundreds of other attempted penetrations; but being unrelated would
be all the more of a concern since that would indicate that
crosswire.org is literally randomly poking at other hosts. Hence,
wondering whether there has been a compromise. It's running RHEL,
which would be an unusual source of that sort of compromise.<br>
</body>
</html>