Security Incidents mailing list archives
large scale distributed scan from Israel
From: Russell Fulton <r.fulton () auckland ac nz>
Date: Tue, 1 Aug 2000 14:09:51 +1200
HI, This is a slightly edited (and truncated -- I've deleted most of the logs) report I have just sent off to AusCERT about this incident. AusCERT are trying to contact people in Israel... Summary of my analysis to date: Duration: 24th Jul 2000 at 19:11 (UTC) to present. Frequency: 50 - 100 probes an hour from several different IP addresses. The two addresses in 62.0.55\16 seem to be active intermittently over at least 4 days -- my slow scan detector picked this up. The other source address are active for quite short periods. Either these people have *a lot* (hundreds) of systems at their disposal or possibly they have compromised one system at which can 'see' traffic for a large chunk of Israel's IP traffic and they are scanning using IP addresses that they know are not active and snooping the responses. Either scenario is cause for concern. Typically each source IP seems to be 'active' for about half an hour and probes a dozen or so addresses in our /16 network (130.216) with the same last octet. e.g. pulling 212.179.30.13 from the log we get: 31 Jul 00 15:52:10 s tcp 212.179.30.13.23226 -> 130.216.4.18.110 5 0 0 0 s 31 Jul 00 15:54:47 tcp 212.179.30.13.20184 <| 130.216.196.18.143 1 1 0 0 sR 31 Jul 00 15:58:28 s tcp 212.179.30.13.20600 -> 130.216.20.18.143 5 0 0 0 s 31 Jul 00 15:59:37 s tcp 212.179.30.13.20728 -> 130.216.148.18.110 5 0 0 0 s 31 Jul 00 16:01:36 s tcp 212.179.30.13.20950 -> 130.216.52.18.110 5 0 0 0 s 31 Jul 00 16:02:57 s tcp 212.179.30.13.21101 -> 130.216.116.18.110 5 0 0 0 s 31 Jul 00 16:04:09 s tcp 212.179.30.13.21234 -> 130.216.12.18.143 5 0 0 0 s 31 Jul 00 16:09:52 s tcp 212.179.30.13.21864 -> 130.216.28.18.143 5 0 0 0 s 31 Jul 00 16:12:24 s tcp 212.179.30.13.22140 -> 130.216.60.18.143 5 0 0 0 s 31 Jul 00 16:13:48 s tcp 212.179.30.13.22294 -> 130.216.124.18.143 5 0 0 0 s 31 Jul 00 16:19:33 tcp 212.179.30.13.22917 <| 130.216.162.18.143 1 1 0 0 sR 31 Jul 00 16:18:30 s tcp 212.179.30.13.22804 -> 130.216.34.18.143 2 0 0 0 s There seem to be two scans running probing different third octets. Cheers, Russell. Russell Fulton, The Univesity of Auckland, New Zealand
Current thread:
- large scale distributed scan from Israel Russell Fulton (Aug 01)
- Re: large scale distributed scan from Israel mixter (Aug 02)
- Re: large scale distributed scan from Israel Pavel Lozhkin (Aug 03)
- Re: large scale distributed scan from Israel mixter (Aug 02)