Re: Is my 520 being hacked?

["James H. H. Lampert" <jamesl@xxxxxxxxxxxxxxxxx>]

Yesterday, somebody mentioned that if a box runs a POP3 server, it's 
going to attract random spammer traffic.

I can also say that likewise if you have port 80 open, even if it 
doesn't actually serve web pages (e.g., it runs a web service instead), 
it's going to attract robotic web traffic. Our authorization code server 
runs on port 80, in order to maximize the chances that a customer will 
actually be able to reach it with one of our client programs, but only 
understands authorization code requests. It does, however, log every 
single request it receives, whether it understands it or not, and I 
don't think I've ever inspected one of its logs without seeing at least 
one request looking for a web page. Ususally, in fact, there are more of 
those than there are legitimate authorization code requests.

--
JHHL