Microsoft FTPD examples

Sample 1:

14:03:19 192.168.2.187 [62]USER Administrator 331 0
14:03:19 192.168.2.187 [62]PASS - 530 1326
14:03:19 192.168.2.187 [62]USER Administrator 331 0
14:03:19 192.168.2.187 [62]PASS - 530 1326
14:03:19 192.168.2.187 [62]USER Administrator 331 0
14:03:20 192.168.2.187 [62]PASS - 530 1326
14:03:20 192.168.2.187 [62]USER Administrator 331 0
14:03:20 192.168.2.187 [62]PASS - 530 1326
14:03:20 192.168.2.187 [62]USER Administrator 331 0
14:03:20 192.168.2.187 [62]PASS - 530 1326
14:03:21 192.168.2.187 [62]USER Administrator 331 0
14:03:21 192.168.2.187 [62]PASS - 530 1326
14:37:52 10.1.2.35 [63]USER username 331 0
14:37:52 10.1.2.35 [63]PASS - 230 0
14:37:52 10.1.2.35 [63]CWD /dir 250 0
14:37:52 10.1.2.35 [63]CWD /dir/_mm 550 2
14:37:52 10.1.2.35 [63]CWD /dir/_notes 250 0
14:37:54 10.1.2.35 [63]CWD / 250 0
14:37:54 10.1.2.35 [63]MKD /dir/XYIZNWSK 257 0
14:37:54 10.1.2.35 [63]CWD /dir 250 0
14:37:54 10.1.2.35 [63]CWD / 250 0
14:37:54 10.1.2.35 [63]RMD /dir/XYIZNWSK 250 0

Sample 2:

12:48:44 x.x.180.116 [11]USER anonymous 331 0
12:48:44 x.x.180.116 [11]PASS IEUser@ 530 1326
12:48:44 x.x.180.116 [12]USER administrator 331 0
12:48:44 x.x.180.116 [12]PASS - 530 1326

Sample 3:

#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2006-09-23 17:49:32
#Fields: time c-ip cs-username s-sitename s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken cs-version cs-host cs(User-Agent) cs(Cookie) cs(Referer)
17:57:59 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]USER Administrator - 331 0 0 0 0 FTP - - - -
17:57:59 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]PASS - - 230 0 0 0 16 FTP - - - -
17:58:11 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]sent /wwwroot/winkel/weekrapport.asp - 226 0 0 0 0 FTP - - - -
17:58:11 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]sent /wwwroot/winkel/weekrapport.asp - 226 0 0 0 0 FTP - - - -
17:58:11 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]sent /wwwroot/winkel/weekrapport.asp - 226 0 14903 0 250 FTP - - - -
17:58:32 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]created weekrapport.asp - 226 0 0 14874 610 FTP - - - -
17:58:42 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]sent /wwwroot/develop/weekrapport.asp - 226 0 0 0 0 FTP - - - -
17:58:42 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]sent /wwwroot/develop/weekrapport.asp - 226 0 0 0 0 FTP - - - -
17:58:42 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]sent /wwwroot/develop/weekrapport.asp - 226 0 14903 0 547 FTP - - - -
17:58:49 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]created weekrapport.asp - 226 0 0 14874 594 FTP - - - -
17:58:57 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]QUIT - - 250 0 0 0 0 FTP - - - -

Sample 4:

2004-12-30 11:24:41 203.115.228.178 ftp MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [12]USER ftp - 331 0 FTP - - - -

2004-12-30 11:24:41 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [12]PASS ftp@ftp.net - 530 1326 FTP - -

2004-12-30 11:24:43 203.115.228.178 anyone MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [13]USER anyone - 331 0 FTP - - - -

2004-12-30 11:24:43 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [13]PASS - - 530 1326 FTP - - - -

2004-12-30 11:24:44 203.115.228.178 root MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [14]USER root - 331 0 FTP - - - -

2004-12-30 11:24:44 203.115.228.178 admin MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [15]USER admin - 331 0 FTP - - - -

2004-12-30 11:24:44 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [14]PASS - - 530 1326 FTP - - - -

2004-12-30 11:24:44 203.115.228.178 webmaster MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [16]USER webmaster - 331 0 FTP

2004-12-30 11:24:44 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [15]PASS - - 530 1326 FTP - - - -

2004-12-30 11:24:44 203.115.228.178 user MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [17]USER user - 331 0 FTP - - - -

2004-12-30 11:24:44 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [16]PASS - - 530 1326 FTP - - - -

2004-12-30 11:24:44 203.115.228.178 test MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [18]USER test - 331 0 FTP - - - -

2004-12-30 11:24:44 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [17]PASS - - 530 1326 FTP - - - -

2004-12-30 11:24:45 203.115.228.178 web MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [19]USER web - 331 0 FTP - - - -

2004-12-30 11:24:45 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [18]PASS - - 530 1326 FTP - - - -

2004-12-30 11:24:45 203.115.228.178 www MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [20]USER www - 331 0 FTP - - - -

2004-12-30 11:24:45 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [19]PASS - - 530 1326 FTP - - - -

2004-12-30 11:24:45 203.115.228.178 administrator MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [22]USER administrator - 331

2004-12-30 11:24:45 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [21]PASS - - 530 1326 FTP - - - -

2004-12-30 11:24:45 203.115.228.178 sybase MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [25]USER sybase - 331 0 FTP - - - -

2004-12-30 11:24:45 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [23]PASS - - 530 1326 FTP - - - -

2004-12-30 11:24:45 203.115.228.178 - MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [24]PASS - - 530 1326 FTP - - - -

2004-12-30 11:24:45 203.115.228.178 user MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [27]USER user - 331 0 FTP - - - -

2004-12-30 11:24:45 203.115.228.178 webmaster MSFTPSVC1 MULTIMEDIA 192.168.0.203 21 [26]USER webmaster - 331 0 FTP -

Sample 5:

13:15:45 172.28.129.116 [51]USER xxxxx 331 0
13:15:46 172.28.129.116 [51]PASS - 230 0
13:15:56 172.28.129.116 [51]MKD 20051103 257 0
13:15:57 172.28.129.116 [51]CWD 20051103 250 0
13:17:19 172.28.129.116 [51]created /filename 226 0
13:18:44 172.28.129.116 [51]QUIT - 226 0
13:39:13 160.164.22.7 [52]USER anonymous 331 0
13:39:13 160.164.22.7 [52]PASS opss 530 1326
13:39:13 160.164.22.7 [52]QUIT - 530 0

Table Of Contents