Security Incidents mailing list archives

Re: distributed SubSeven assault?

From: Grant Parkinson <grantp () THEMOMENT COM>
Date: Thu, 1 Feb 2001 15:31:33 -0800

Hi,

I would put money on these scans originating from YOUR OWN networks.  If not
your network then your ISPs network.  The netbois data is a common red flag
for a poorly configured nat device.

A few notes:
If this is a remote scan, every hop between you and the scanner are
configured improperly. EXTREMELY unlikely.  If a "blackhat" is clever enough
to bypass your upstream routing equipment, its not likely they would be
blasting noisy scans about.

Likely source, Your network.  Less likely source, your isp.

-grant

-----Original Message-----
From: Shoten [mailto:shoten () STARPOWER NET]
Sent: Thursday, February 01, 2001 11:17 AM
To: INCIDENTS () SECURITYFOCUS COM
Subject: Re: distributed SubSeven assault?

Have you been able to ascertain if all sources were actually
online and
responsive?  It could be something like an nmap scan using a
slew of decoys.
Another way to tell might be checking to see if each (or any)
of the sources
covered the entire range that got hit.  Also, although I
would consider this
far less likely, there might be a network that is between you
and any of the
sources; this way, even though the connection attempts were
spoofed, the
responses could still route to the attacker.

----- Original Message -----
From: "Glenn Forbes Fleming Larratt" <glratt () IO COM>
To: <INCIDENTS () SECURITYFOCUS COM>
Sent: Thursday, February 01, 2001 9:18 AM
Subject: distributed SubSeven assault?

After no less the 72 hours virtually free of TCP 27374 (SubSeven),

abruptly

at 13:23 (GMT) commenced such scans of our Class B. Simultaneously.
On different ranges of our address space. From, by my count, no
fewer than twenty different sources (and my "IDS" is syslogging from
my border Cisco, so we're missing a lot).

Then at 13:47 GMT they abruptly ceased.

Is anyone else seeing this?

Does anyone grok it?

Four most heinous offenders below:

Feb  1 13:23:32 tcp 24.66.135.230(3726) ->

my.net.59.27(27374), 1 packet

Feb  1 13:23:44 tcp 24.66.135.230(3734) ->

my.net.59.35(27374), 1 packet

Feb  1 13:24:08 tcp 24.66.135.230(3821) ->

my.net.59.123(27374), 1 packet

Feb  1 13:24:12 tcp 24.66.135.230(3820) ->

my.net.59.122(27374), 1 packet

Feb  1 13:24:18 tcp 24.66.135.230(3830) ->

my.net.59.132(27374), 1 packet

Feb  1 13:24:41 tcp 24.66.135.230(3856) ->

my.net.59.158(27374), 1 packet

Feb  1 13:26:15 tcp 24.66.135.230(4103) ->

my.net.60.152(27374), 1 packet

Feb  1 13:26:45 tcp 24.66.135.230(4134) ->

my.net.60.183(27374), 1 packet

Feb  1 13:27:10 tcp 24.66.135.230(4249) ->

my.net.61.43(27374), 1 packet

Feb  1 13:27:20 tcp 24.66.135.230(4259) ->

my.net.61.53(27374), 1 packet

Feb  1 13:28:04 tcp 24.66.135.230(4311) ->

my.net.61.105(27374), 1 packet

Feb  1 13:28:07 tcp 24.66.135.230(4378) ->

my.net.61.173(27374), 1 packet

Feb  1 13:28:50 tcp 24.66.135.230(4430) ->

my.net.61.225(27374), 1 packet

Feb  1 13:29:14 tcp 24.66.135.230(4532) ->

my.net.62.72(27374), 1 packet

Feb  1 13:29:47 tcp 24.66.135.230(4552) ->

my.net.62.93(27374), 1 packet

Feb  1 13:29:58 tcp 24.66.135.230(4572) ->

my.net.62.113(27374), 1 packet

Feb  1 13:30:11 tcp 24.66.135.230(4653) ->

my.net.62.195(27374), 1 packet

Feb  1 13:30:20 tcp 24.66.135.230(4665) ->

my.net.62.207(27374), 1 packet

Feb  1 13:30:22 tcp 24.66.135.230(4667) ->

my.net.62.209(27374), 1 packet

Feb  1 13:31:39 tcp 24.66.135.230(4834) ->

my.net.63.121(27374), 1 packet

Feb  1 13:31:51 tcp 24.66.135.230(4829) ->

my.net.63.116(27374), 1 packet

Feb  1 13:32:02 tcp 24.66.135.230(4878) ->

my.net.63.166(27374), 1 packet

Feb  1 13:32:24 tcp 24.66.135.230(4931) ->

my.net.63.219(27374), 1 packet

Feb  1 13:32:37 tcp 24.66.135.230(4926) ->

my.net.63.214(27374), 1 packet

Feb  1 13:33:10 tcp 24.66.135.230(1052) ->

my.net.64.61(27374), 1 packet

Feb  1 13:33:33 tcp 24.66.135.230(1077) ->

my.net.64.87(27374), 1 packet

Feb  1 13:33:50 tcp 24.66.135.230(1177) ->

my.net.64.187(27374), 1 packet

Feb  1 13:34:19 tcp 24.66.135.230(1184) ->

my.net.64.195(27374), 1 packet

Feb  1 13:34:30 tcp 24.66.135.230(1214) ->

my.net.64.225(27374), 1 packet

Feb  1 13:34:58 tcp 24.66.135.230(1325) ->

my.net.65.81(27374), 1 packet

Feb  1 13:35:04 tcp 24.66.135.230(1316) ->

my.net.65.72(27374), 1 packet

Feb  1 13:36:02 tcp 24.66.135.230(1464) ->

my.net.65.221(27374), 1 packet

Feb  1 13:36:05 tcp 24.66.135.230(1476) ->

my.net.65.233(27374), 1 packet

Feb  1 13:36:11 tcp 24.66.135.230(1470) ->

my.net.65.227(27374), 1 packet

Feb  1 13:36:24 tcp 24.66.135.230(1479) ->

my.net.65.236(27374), 1 packet

Feb  1 13:37:13 tcp 24.66.135.230(1635) ->

my.net.66.137(27374), 1 packet

Feb  1 13:37:20 tcp 24.66.135.230(1622) ->

my.net.66.124(27374), 1 packet

Feb  1 13:37:31 tcp 24.66.135.230(1636) ->

my.net.66.138(27374), 1 packet

Feb  1 13:39:25 tcp 24.66.135.230(1891) ->

my.net.67.137(27374), 1 packet

Feb  1 13:39:35 tcp 24.66.135.230(1911) ->

my.net.67.157(27374), 1 packet

Feb  1 13:40:44 tcp 24.66.135.230(2089) ->

my.net.68.81(27374), 1 packet

Feb  1 13:42:37 tcp 24.66.135.230(2322) ->

my.net.69.60(27374), 1 packet

Feb  1 13:43:16 tcp 24.66.135.230(2456) ->

my.net.69.196(27374), 1 packet

Feb  1 13:43:48 tcp 24.66.135.230(2523) ->

my.net.70.7(27374), 1 packet

Feb  1 13:43:56 tcp 24.66.135.230(2547) ->

my.net.70.31(27374), 1 packet

Feb  1 13:44:09 tcp 24.66.135.230(2538) ->

my.net.70.22(27374), 1 packet



Feb  1 13:23:28 tcp 24.43.169.231(4501) ->

my.net.186.155(27374), 1 packet

Feb  1 13:23:34 tcp 24.43.169.231(4492) ->

my.net.186.146(27374), 1 packet

Feb  1 13:23:47 tcp 24.43.169.231(4492) ->

my.net.186.146(27374), 1 packet

Feb  1 13:23:49 tcp 24.43.169.231(4542) ->

my.net.186.198(27374), 1 packet

Feb  1 13:24:15 tcp 24.43.169.231(4598) ->

my.net.187.0(27374), 1 packet

Feb  1 13:24:31 tcp 24.43.169.231(4629) ->

my.net.187.32(27374), 1 packet

Feb  1 13:24:48 tcp 24.43.169.231(4639) ->

my.net.187.43(27374), 1 packet

Feb  1 13:24:54 tcp 24.43.169.231(4669) ->

my.net.187.74(27374), 1 packet

Feb  1 13:25:07 tcp 24.43.169.231(4689) ->

my.net.187.95(27374), 1 packet

Feb  1 13:25:20 tcp 24.43.169.231(4727) ->

my.net.187.134(27374), 1 packet

Feb  1 13:25:26 tcp 24.43.169.231(4719) ->

my.net.187.126(27374), 1 packet

Feb  1 13:25:44 tcp 24.43.169.231(4767) ->

my.net.187.176(27374), 1 packet

Feb  1 13:25:52 tcp 24.43.169.231(4779) ->

my.net.187.188(27374), 1 packet

Feb  1 13:26:04 tcp 24.43.169.231(4799) ->

my.net.187.209(27374), 1 packet

Feb  1 13:26:06 tcp 24.43.169.231(4814) ->

my.net.187.225(27374), 1 packet

Feb  1 13:26:10 tcp 24.43.169.231(4831) ->

my.net.187.242(27374), 1 packet

Feb  1 13:26:17 tcp 24.43.169.231(4798) ->

my.net.187.208(27374), 1 packet

Feb  1 13:26:34 tcp 24.43.169.231(4869) ->

my.net.188.26(27374), 1 packet

Feb  1 13:27:18 tcp 24.43.169.231(4941) ->

my.net.188.101(27374), 1 packet

Feb  1 13:27:31 tcp 24.43.169.231(4961) ->

my.net.188.122(27374), 1 packet

Feb  1 13:28:22 tcp 24.43.169.231(1101) ->

my.net.188.241(27374), 1 packet

Feb  1 13:28:28 tcp 24.43.169.231(1133) ->

my.net.189.18(27374), 1 packet

Feb  1 13:28:35 tcp 24.43.169.231(1103) ->

my.net.188.243(27374), 1 packet

Feb  1 13:28:37 tcp 24.43.169.231(1143) ->

my.net.189.29(27374), 1 packet

Feb  1 13:28:59 tcp 24.43.169.231(1141) ->

my.net.189.27(27374), 1 packet

Feb  1 13:29:03 tcp 24.43.169.231(1194) ->

my.net.189.82(27374), 1 packet

Feb  1 13:30:08 tcp 24.43.169.231(1325) ->

my.net.189.218(27374), 1 packet

Feb  1 13:30:18 tcp 24.43.169.231(1347) ->

my.net.189.241(27374), 1 packet

Feb  1 13:30:27 tcp 24.43.169.231(1318) ->

my.net.189.211(27374), 1 packet

Feb  1 13:31:10 tcp 24.43.169.231(1442) ->

my.net.190.84(27374), 1 packet

Feb  1 13:31:14 tcp 24.43.169.231(1458) ->

my.net.190.100(27374), 1 packet

Feb  1 13:31:20 tcp 24.43.169.231(1447) ->

my.net.190.89(27374), 1 packet

Feb  1 13:31:50 tcp 24.43.169.231(1521) ->

my.net.190.166(27374), 1 packet

Feb  1 13:32:03 tcp 24.43.169.231(1560) ->

my.net.190.206(27374), 1 packet

Feb  1 13:32:12 tcp 24.43.169.231(1562) ->

my.net.190.209(27374), 1 packet

Feb  1 13:32:15 tcp 24.43.169.231(1561) ->

my.net.190.208(27374), 1 packet

Feb  1 13:32:23 tcp 24.43.169.231(1555) ->

my.net.190.201(27374), 1 packet

Feb  1 13:33:00 tcp 24.43.169.231(1631) ->

my.net.191.24(27374), 1 packet

Feb  1 13:33:30 tcp 24.43.169.231(1718) ->

my.net.191.115(27374), 1 packet

Feb  1 13:34:02 tcp 24.43.169.231(1746) ->

my.net.191.144(27374), 1 packet

Feb  1 13:34:08 tcp 24.43.169.231(1794) ->

my.net.191.194(27374), 1 packet

Feb  1 13:34:20 tcp 24.43.169.231(1811) ->

my.net.191.212(27374), 1 packet

Feb  1 13:34:21 tcp 24.43.169.231(1832) ->

my.net.191.233(27374), 1 packet

Feb  1 13:34:26 tcp 24.43.169.231(1820) ->

my.net.191.221(27374), 1 packet

Feb  1 13:34:28 tcp 24.43.169.231(1808) ->

my.net.191.208(27374), 1 packet

Feb  1 13:34:40 tcp 24.43.169.231(1824) ->

my.net.191.225(27374), 1 packet

Feb  1 13:34:51 tcp 24.43.169.231(1863) ->

my.net.192.10(27374), 1 packet

Feb  1 13:35:42 tcp 24.43.169.231(1944) ->

my.net.192.94(27374), 1 packet

Feb  1 13:35:44 tcp 24.43.169.231(1998) ->

my.net.192.150(27374), 1 packet

Feb  1 13:36:06 tcp 24.43.169.231(2022) ->

my.net.192.175(27374), 1 packet

Feb  1 13:36:10 tcp 24.43.169.231(2057) ->

my.net.192.211(27374), 1 packet

Feb  1 13:36:20 tcp 24.43.169.231(2022) ->

my.net.192.175(27374), 1 packet

Feb  1 13:36:32 tcp 24.43.169.231(2047) ->

my.net.192.201(27374), 1 packet

Feb  1 13:37:25 tcp 24.43.169.231(2191) ->

my.net.193.95(27374), 1 packet

Feb  1 13:37:41 tcp 24.43.169.231(2235) ->

my.net.193.140(27374), 1 packet

Feb  1 13:37:42 tcp 24.43.169.231(2228) ->

my.net.193.133(27374), 1 packet

Feb  1 13:37:48 tcp 24.43.169.231(2217) ->

my.net.193.122(27374), 1 packet

Feb  1 13:37:49 tcp 24.43.169.231(2197) ->

my.net.193.101(27374), 1 packet

Feb  1 13:37:53 tcp 24.43.169.231(2247) ->

my.net.193.153(27374), 1 packet

Feb  1 13:38:27 tcp 24.43.169.231(2291) ->

my.net.193.199(27374), 1 packet

Feb  1 13:38:40 tcp 24.43.169.231(2289) ->

my.net.193.197(27374), 1 packet

Feb  1 13:38:41 tcp 24.43.169.231(2309) ->

my.net.193.217(27374), 1 packet

Feb  1 13:39:10 tcp 24.43.169.231(2393) ->

my.net.194.49(27374), 1 packet

Feb  1 13:39:18 tcp 24.43.169.231(2404) ->

my.net.194.60(27374), 1 packet

Feb  1 13:39:55 tcp 24.43.169.231(2441) ->

my.net.194.99(27374), 1 packet

Feb  1 13:39:57 tcp 24.43.169.231(2496) ->

my.net.194.156(27374), 1 packet

Feb  1 13:40:06 tcp 24.43.169.231(2502) ->

my.net.194.162(27374), 1 packet

Feb  1 13:40:20 tcp 24.43.169.231(2502) ->

my.net.194.162(27374), 1 packet

Feb  1 13:40:59 tcp 24.43.169.231(2626) ->

my.net.195.35(27374), 1 packet

Feb  1 13:41:12 tcp 24.43.169.231(2644) ->

my.net.195.54(27374), 1 packet

Feb  1 13:41:16 tcp 24.43.169.231(2660) ->

my.net.195.70(27374), 1 packet

Feb  1 13:41:37 tcp 24.43.169.231(2707) ->

my.net.195.119(27374), 1 packet

Feb  1 13:41:49 tcp 24.43.169.231(2724) ->

my.net.195.137(27374), 1 packet

Feb  1 13:42:06 tcp 24.43.169.231(2759) ->

my.net.195.173(27374), 1 packet

Feb  1 13:42:11 tcp 24.43.169.231(2749) ->

my.net.195.163(27374), 1 packet

Feb  1 13:42:27 tcp 24.43.169.231(2802) ->

my.net.195.218(27374), 1 packet

Feb  1 13:42:39 tcp 24.43.169.231(2823) ->

my.net.195.240(27374), 1 packet

Feb  1 13:43:28 tcp 24.43.169.231(2916) ->

my.net.196.81(27374), 1 packet

Feb  1 13:43:33 tcp 24.43.169.231(2933) ->

my.net.196.98(27374), 1 packet

Feb  1 13:43:51 tcp 24.43.169.231(2943) ->

my.net.196.109(27374), 1 packet

Feb  1 13:44:33 tcp 24.43.169.231(3045) ->

my.net.196.215(27374), 1 packet

Feb  1 13:44:46 tcp 24.43.169.231(3066) ->

my.net.196.237(27374), 1 packet

Feb  1 13:45:12 tcp 24.43.169.231(3124) ->

my.net.197.41(27374), 1 packet

Feb  1 13:45:19 tcp 24.43.169.231(3096) ->

my.net.197.12(27374), 1 packet

Feb  1 13:45:31 tcp 24.43.169.231(3116) ->

my.net.197.33(27374), 1 packet

Feb  1 13:46:09 tcp 24.43.169.231(3192) ->

my.net.197.112(27374), 1 packet

Feb  1 13:46:12 tcp 24.43.169.231(3243) ->

my.net.197.165(27374), 1 packet

Feb  1 13:46:35 tcp 24.43.169.231(3252) ->

my.net.197.174(27374), 1 packet

Feb  1 13:46:49 tcp 24.43.169.231(3327) ->

my.net.197.252(27374), 1 packet


Feb  1 13:23:21 tcp 24.64.219.53(1096) ->

my.net.140.32(27374), 1 packet

Feb  1 13:23:55 tcp 24.64.219.53(1184) ->

my.net.140.123(27374), 1 packet

Feb  1 13:24:13 tcp 24.64.219.53(1229) ->

my.net.140.170(27374), 1 packet

Feb  1 13:24:19 tcp 24.64.219.53(1233) ->

my.net.140.174(27374), 1 packet

Feb  1 13:24:43 tcp 24.64.219.53(1295) ->

my.net.140.239(27374), 1 packet

Feb  1 13:24:46 tcp 24.64.219.53(1288) ->

my.net.140.232(27374), 1 packet

Feb  1 13:25:21 tcp 24.64.219.53(1371) ->

my.net.141.62(27374), 1 packet

Feb  1 13:25:53 tcp 24.64.219.53(1447) ->

my.net.141.141(27374), 1 packet

Feb  1 13:27:39 tcp 24.64.219.53(1683) ->

my.net.142.130(27374), 1 packet

Feb  1 13:27:59 tcp 24.64.219.53(1734) ->

my.net.142.183(27374), 1 packet

Feb  1 13:29:11 tcp 24.64.219.53(1878) ->

my.net.143.77(27374), 1 packet

Feb  1 13:29:43 tcp 24.64.219.53(1942) ->

my.net.143.144(27374), 1 packet

Feb  1 13:29:46 tcp 24.64.219.53(1954) ->

my.net.143.156(27374), 1 packet

Feb  1 13:30:17 tcp 24.64.219.53(2017) ->

my.net.143.222(27374), 1 packet

Feb  1 13:30:38 tcp 24.64.219.53(2059) ->

my.net.144.9(27374), 1 packet

Feb  1 13:31:00 tcp 24.64.219.53(2104) ->

my.net.144.56(27374), 1 packet

Feb  1 13:31:26 tcp 24.64.219.53(2170) ->

my.net.144.125(27374), 1 packet

Feb  1 13:31:29 tcp 24.64.219.53(2161) ->

my.net.144.116(27374), 1 packet

Feb  1 13:32:01 tcp 24.64.219.53(2239) ->

my.net.144.197(27374), 1 packet

Feb  1 13:32:35 tcp 24.64.219.53(2327) ->

my.net.145.32(27374), 1 packet

Feb  1 13:32:38 tcp 24.64.219.53(2327) ->

my.net.145.32(27374), 1 packet

Feb  1 13:32:55 tcp 24.64.219.53(2359) ->

my.net.145.65(27374), 1 packet

Feb  1 13:33:19 tcp 24.64.219.53(2408) ->

my.net.145.116(27374), 1 packet

Feb  1 13:33:44 tcp 24.64.219.53(2462) ->

my.net.145.173(27374), 1 packet

Feb  1 13:33:47 tcp 24.64.219.53(2477) ->

my.net.145.188(27374), 1 packet

Feb  1 13:33:53 tcp 24.64.219.53(2481) ->

my.net.145.192(27374), 1 packet

Feb  1 13:35:49 tcp 24.64.219.53(2742) ->

my.net.146.208(27374), 1 packet

Feb  1 13:35:59 tcp 24.64.219.53(2742) ->

my.net.146.208(27374), 1 packet

Feb  1 13:36:27 tcp 24.64.219.53(2827) ->

my.net.147.40(27374), 1 packet

Feb  1 13:36:59 tcp 24.64.219.53(2892) ->

my.net.147.108(27374), 1 packet

Feb  1 13:37:08 tcp 24.64.219.53(2910) ->

my.net.147.126(27374), 1 packet

Feb  1 13:37:36 tcp 24.64.219.53(2965) ->

my.net.147.184(27374), 1 packet

Feb  1 13:37:43 tcp 24.64.219.53(2977) ->

my.net.147.196(27374), 1 packet

Feb  1 13:37:57 tcp 24.64.219.53(3027) ->

my.net.147.248(27374), 1 packet

Feb  1 13:38:17 tcp 24.64.219.53(3044) ->

my.net.148.10(27374), 1 packet

Feb  1 13:38:31 tcp 24.64.219.53(3099) ->

my.net.148.67(27374), 1 packet

Feb  1 13:38:34 tcp 24.64.219.53(3099) ->

my.net.148.67(27374), 1 packet

Feb  1 13:38:54 tcp 24.64.219.53(3159) ->

my.net.148.129(27374), 1 packet

Feb  1 13:40:12 tcp 24.64.219.53(3307) ->

my.net.149.27(27374), 1 packet

Feb  1 13:40:47 tcp 24.64.219.53(3363) ->

my.net.149.86(27374), 1 packet

Feb  1 13:41:00 tcp 24.64.219.53(3419) ->

my.net.149.144(27374), 1 packet

Feb  1 13:41:04 tcp 24.64.219.53(3430) ->

my.net.149.155(27374), 1 packet

Feb  1 13:41:09 tcp 24.64.219.53(3434) ->

my.net.149.159(27374), 1 packet

Feb  1 13:41:35 tcp 24.64.219.53(3499) ->

my.net.149.227(27374), 1 packet

Feb  1 13:41:38 tcp 24.64.219.53(3509) ->

my.net.149.237(27374), 1 packet

Feb  1 13:42:46 tcp 24.64.219.53(3652) ->

my.net.150.130(27374), 1 packet

Feb  1 13:42:53 tcp 24.64.219.53(3656) ->

my.net.150.134(27374), 1 packet

Feb  1 13:43:07 tcp 24.64.219.53(3704) ->

my.net.150.184(27374), 1 packet

Feb  1 13:43:44 tcp 24.64.219.53(3782) ->

my.net.151.9(27374), 1 packet

Feb  1 13:44:16 tcp 24.64.219.53(3851) ->

my.net.151.81(27374), 1 packet

Feb  1 13:44:19 tcp 24.64.219.53(3859) ->

my.net.151.89(27374), 1 packet

Feb  1 13:44:50 tcp 24.64.219.53(3912) ->

my.net.151.145(27374), 1 packet

Feb  1 13:44:53 tcp 24.64.219.53(3928) ->

my.net.151.161(27374), 1 packet

Feb  1 13:44:59 tcp 24.64.219.53(3932) ->

my.net.151.165(27374), 1 packet


Feb  1 13:23:24 tcp 24.42.80.178(4347) ->

my.net.117.16(27374), 1 packet

Feb  1 13:24:09 tcp 24.42.80.178(4440) ->

my.net.117.112(27374), 1 packet

Feb  1 13:25:41 tcp 24.42.80.178(4589) ->

my.net.118.11(27374), 1 packet

Feb  1 13:25:43 tcp 24.42.80.178(4636) ->

my.net.118.59(27374), 1 packet

Feb  1 13:26:15 tcp 24.42.80.178(4728) ->

my.net.118.154(27374), 1 packet

Feb  1 13:26:26 tcp 24.42.80.178(4741) ->

my.net.118.168(27374), 1 packet

Feb  1 13:27:01 tcp 24.42.80.178(4826) ->

my.net.119.0(27374), 1 packet

Feb  1 13:27:22 tcp 24.42.80.178(4838) ->

my.net.119.13(27374), 1 packet

Feb  1 13:27:35 tcp 24.42.80.178(4845) ->

my.net.119.20(27374), 1 packet

Feb  1 13:27:38 tcp 24.42.80.178(4890) ->

my.net.119.66(27374), 1 packet

Feb  1 13:28:21 tcp 24.42.80.178(4993) ->

my.net.119.173(27374), 1 packet

Feb  1 13:28:23 tcp 24.42.80.178(4990) ->

my.net.119.170(27374), 1 packet

Feb  1 13:28:55 tcp 24.42.80.178(1040) ->

my.net.119.196(27374), 1 packet

Feb  1 13:29:09 tcp 24.42.80.178(1120) ->

my.net.120.23(27374), 1 packet

Feb  1 13:29:17 tcp 24.42.80.178(1144) ->

my.net.120.47(27374), 1 packet

Feb  1 13:30:25 tcp 24.42.80.178(1291) ->

my.net.120.198(27374), 1 packet

Feb  1 13:30:49 tcp 24.42.80.178(1362) ->

my.net.121.15(27374), 1 packet

Feb  1 13:31:34 tcp 24.42.80.178(1409) ->

my.net.121.64(27374), 1 packet

Feb  1 13:32:06 tcp 24.42.80.178(1512) ->

my.net.121.170(27374), 1 packet

Feb  1 13:32:42 tcp 24.42.80.178(1590) ->

my.net.121.252(27374), 1 packet

Feb  1 13:33:08 tcp 24.42.80.178(1641) ->

my.net.122.49(27374), 1 packet

Feb  1 13:33:16 tcp 24.42.80.178(1667) ->

my.net.122.76(27374), 1 packet

Feb  1 13:33:43 tcp 24.42.80.178(1734) ->

my.net.122.145(27374), 1 packet

Feb  1 13:33:51 tcp 24.42.80.178(1744) ->

my.net.122.155(27374), 1 packet

Feb  1 13:34:11 tcp 24.42.80.178(1768) ->

my.net.122.180(27374), 1 packet

Feb  1 13:34:14 tcp 24.42.80.178(1762) ->

my.net.122.173(27374), 1 packet

Feb  1 13:35:43 tcp 24.42.80.178(1972) ->

my.net.123.136(27374), 1 packet

Feb  1 13:35:45 tcp 24.42.80.178(2016) ->

my.net.123.180(27374), 1 packet

Feb  1 13:35:56 tcp 24.42.80.178(2018) ->

my.net.123.183(27374), 1 packet

Feb  1 13:36:31 tcp 24.42.80.178(2045) ->

my.net.123.211(27374), 1 packet

Feb  1 13:36:42 tcp 24.42.80.178(2128) ->

my.net.124.40(27374), 1 packet

Feb  1 13:37:16 tcp 24.42.80.178(2146) ->

my.net.124.59(27374), 1 packet

Feb  1 13:37:51 tcp 24.42.80.178(2286) ->

my.net.124.204(27374), 1 packet

Feb  1 13:37:54 tcp 24.42.80.178(2282) ->

my.net.124.200(27374), 1 packet

Feb  1 13:38:02 tcp 24.42.80.178(2297) ->

my.net.124.216(27374), 1 packet

Feb  1 13:38:25 tcp 24.42.80.178(2365) ->

my.net.125.29(27374), 1 packet

Feb  1 13:38:35 tcp 24.42.80.178(2374) ->

my.net.125.39(27374), 1 packet

Feb  1 13:38:59 tcp 24.42.80.178(2381) ->

my.net.125.46(27374), 1 packet

Feb  1 13:39:31 tcp 24.42.80.178(2482) ->

my.net.125.151(27374), 1 packet

Feb  1 13:39:59 tcp 24.42.80.178(2545) ->

my.net.125.217(27374), 1 packet

Feb  1 13:40:30 tcp 24.42.80.178(2634) ->

my.net.126.52(27374), 1 packet

Feb  1 13:41:25 tcp 24.42.80.178(2731) ->

my.net.126.153(27374), 1 packet

Feb  1 13:41:42 tcp 24.42.80.178(2781) ->

my.net.126.205(27374), 1 packet

Feb  1 13:42:25 tcp 24.42.80.178(2895) ->

my.net.127.66(27374), 1 packet

Feb  1 13:42:28 tcp 24.42.80.178(2874) ->

my.net.127.45(27374), 1 packet

Feb  1 13:42:35 tcp 24.42.80.178(2905) ->

my.net.127.77(27374), 1 packet

Feb  1 13:43:42 tcp 24.42.80.178(3028) ->

my.net.127.204(27374), 1 packet

Feb  1 13:44:30 tcp 24.42.80.178(3166) ->

my.net.128.91(27374), 1 packet



--
Glenn Forbes Fleming Larratt         The Lab Ratt (not briggs :-)
glratt () io com                        http://www.io.com/~glratt
There are imaginary bugs to chase in heaven.

Current thread:

distributed SubSeven assault? Glenn Forbes Fleming Larratt (Feb 01)
- Re: distributed SubSeven assault? Shoten (Feb 01)
- <Possible follow-ups>
- Re: distributed SubSeven assault? Grant Parkinson (Feb 01)