I stumbled on to excessive logins by [log in to unmask] Here are some counts, which can only be done via an automated process. I served the user out, but it continued to try until 3:45 this am.

LISTSERV-20090517.LOG:0
LISTSERV-20090518.LOG:9639
LISTSERV-20090519.LOG:10641
LISTSERV-20090520.LOG:8182
LISTSERV-20090521.LOG:6560

21 May 2009 00:00:45 From [ANONYMOUS]@LISTSERV.SYR.EDU: X-LOGIN [log in to unmask] 64.132.204.25 PW=[redacted]
21 May 2009 00:00:45 To   [ANONYMOUS]@LISTSERV.SYR.EDU: ***OK*** 074C6E344A8134FDB7

Here are a couple of iis log entries:

2009-05-22 00:01:43 W3SVC1 128.230.18.252 GET /scripts/wa.exe A2=ind9703a&L=autocat&T=0&F=&S=&X=57277604AA952109A3&Y=tim%40infosolutions.com&P=4884 80 - 64.132.204.25 LC_Bot 200 0 64
2009-05-22 00:01:43 W3SVC1 128.230.18.252 GET /scripts/wa.exe A2=ind9703a&L=autocat&T=0&F=&S=&X=57277604AA952109A3&Y=tim%40infosolutions.com&P=1416 80 - 64.132.204.25 LC_Bot 200 0 109
2009-05-22 00:01:56 W3SVC1 128.230.18.252 GET /scripts/wa.exe A2=ind9703a&L=autocat&T=0&F=&S=&X=57277604AA952109A3&Y=tim%40infosolutions.com&P=1936 80 - 64.132.204.25 LC_Bot 200 0 109

I don't see any more entries in the log after 7:45 this am (corresponding to 3:45 EDT in the listserv logs).

I pass this along to a) alert others it may be happening b) ask if anyone else is seeing it c) general wisdom.

Nelson R. Pardee, Support Analyst, Information Technology & Services
Syracuse University, CST 1-205, Syracuse, NY 13244
(315) 443-1079 [log in to unmask]