finger/IMAP scans

[Neil Ratzlaff <Neil.Ratzlaff () ucop edu>]

I keep seeing people doing combination finger/IMAP scans on our primary and
secondary nameservers.  The number of sources is increasing.  (And the
firewall keeps blocking them.) The ratio is usually about two fingers
followed by an IMAP, they wil try several dozen times, and then they quit.
Does anyone recognize this as a meaningful pattern?  If so, can someone
tell me what they think they are doing?  Assuming there is thought
involved, of course.

Thanks,
Neil