Re: Distributed scan (src port 23) of our whole class C network

["Ralf G. R. Bergs" <rabe () RWTH-Aachen DE>]

On Wed, 24 Jan 2001 11:29:37 +0100, Tom Fischer wrote:

> we are observing these scans with a source port of 23 and various
> attacked ports as well. The scans started at Jan 23 04:00 (UTC+0100
> (MET)) and end at Jan 24 06:00 (UTC+0100 (MET)) from:
>
> 216.22.151.67
> 134.53.215.184
> 204.32.32.250
> 209.220.244.18

In my case at least some of the scans are still going on (12:13 +0100).

> The responsible contact persons were informed.

Thanks, I forgot to do that because I'm rather busy (and not THAT
experienced in these things.)

> 209.240.174.2 does a scan with various source and attacked ports.

Yup, I'm also observing this particular host.

Thanks,

Ralf


--
Sign the EU petition against SPAM:          L I N U X       .~.
http://www.politik-digital.de/spam/        The  Choice      /V\
                                            of a  GNU      /( )\
                                           Generation      ^^-^^