My portsentry said that this people:

217.83.20.90 (pD953145A.dip.t-dialin.net)
210.24.138.178
210.207.14.122
210.175.252.187
61.129.70.10

does TCP SYN/Normal scans on my server, most on port 57, some in the 111. (and some FTP to various IP)

How to know more in detail who they are or what are they looking for ?

Some moderator can look if one of this IP is on the WHT user ip database? ... dunno, cause I started to get scans since I put a post here ... heh :rolleyes:

Regards.

would seem to be random scanning for exploitable services. i see scans for rpc(111) come across almost hourly.

you can find out a bit more information about who they are by going to : http://ww2.arin.net/whois/ or doing whois -h whois.arin.net ip.block on your server.

with regards to what they are looking for.. i could only assume its someone scanning for exploitable boxens.