A method and system for detecting spoofed network connections comprising receiving a connection from a client, delaying sending a greeting message for a delay period, monitoring the connection during the delay period, and if a command is received from the client before the greeting is sent, then identifying the connection as a possible spoofed connection.