[Intrusions] [LOGS] Summary of large-scale portscanning detects
Joel Esler
esler at knology.net
Fri Oct 15 22:32:13 GMT 2004
What kind of script do you have that compiles this list? Is it public?
J
On Oct 14, 2004, at 10:22 AM, Ken.Connelly at uni.edu wrote:
> The following extracts show the beginning and ending of scan activity
> was detected on my network. The number following each set is the total
> number of probes for that source. Timestamps are GMT-0500.
>
> Oct 13 02:22:02 129.173.33.54:50004 -> xxx.yyy.1.0:6112 SYN ******S*
> Oct 13 02:22:02 129.173.33.54:50005 -> xxx.yyy.1.1:6112 SYN ******S*
> Oct 13 02:22:02 129.173.33.54:50006 -> xxx.yyy.1.2:6112 SYN ******S*
> Oct 13 02:22:02 129.173.33.54:50007 -> xxx.yyy.1.3:6112 SYN ******S*
> Oct 13 02:22:05 129.173.33.54:50008 -> xxx.yyy.1.4:6112 SYN ******S*
> Oct 13 02:22:05 129.173.33.54:50009 -> xxx.yyy.1.5:6112 SYN ******S*
> Oct 13 02:22:05 129.173.33.54:50010 -> xxx.yyy.1.6:6112 SYN ******S*
> Oct 13 02:22:05 129.173.33.54:50011 -> xxx.yyy.1.7:6112 SYN ******S*
> [...]
> Oct 13 02:48:11 129.173.33.54:49777 -> xxx.yyy.255.246:6112 SYN
> ******S*
> Oct 13 02:48:11 129.173.33.54:49780 -> xxx.yyy.255.249:6112 SYN
> ******S*
> Oct 13 02:48:11 129.173.33.54:49779 -> xxx.yyy.255.248:6112 SYN
> ******S*
> Oct 13 02:48:11 129.173.33.54:49781 -> xxx.yyy.255.250:6112 SYN
> ******S*
> Oct 13 02:48:12 129.173.33.54:49782 -> xxx.yyy.255.251:6112 SYN
> ******S*
> Oct 13 02:48:12 129.173.33.54:49783 -> xxx.yyy.255.252:6112 SYN
> ******S*
> Oct 13 02:48:12 129.173.33.54:49784 -> xxx.yyy.255.253:6112 SYN
> ******S*
> Oct 13 02:48:12 129.173.33.54:49785 -> xxx.yyy.255.254:6112 SYN
> ******S*
> 74543
>
> Oct 13 06:01:57 192.216.213.250:3788 -> xxx.yyy.1.1:1433 SYN ******S*
> Oct 13 06:01:57 192.216.213.250:3789 -> xxx.yyy.1.2:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3790 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3791 -> xxx.yyy.1.4:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3792 -> xxx.yyy.1.5:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3793 -> xxx.yyy.1.6:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3794 -> xxx.yyy.1.7:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3795 -> xxx.yyy.1.8:1433 SYN ******S*
> [...]
> Oct 13 06:13:55 192.216.213.250:2554 -> xxx.yyy.255.246:1433 SYN
> ******S*
> Oct 13 06:13:55 192.216.213.250:2558 -> xxx.yyy.255.250:1433 SYN
> ******S*
> Oct 13 06:13:55 192.216.213.250:2555 -> xxx.yyy.255.247:1433 SYN
> ******S*
> Oct 13 06:13:55 192.216.213.250:2552 -> xxx.yyy.255.244:1433 SYN
> ******S*
> Oct 13 06:13:55 192.216.213.250:2559 -> xxx.yyy.255.251:1433 SYN
> ******S*
> Oct 13 06:13:55 192.216.213.250:2556 -> xxx.yyy.255.248:1433 SYN
> ******S*
> Oct 13 06:13:55 192.216.213.250:2553 -> xxx.yyy.255.245:1433 SYN
> ******S*
> Oct 13 06:13:55 192.216.213.250:2561 -> xxx.yyy.255.253:1433 SYN
> ******S*
> Oct 13 06:13:55 192.216.213.250:2562 -> xxx.yyy.255.254:1433 SYN
> ******S*
> 70712
>
> Oct 13 04:26:16 166.61.232.146:1539 -> xxx.yyy.1.1:4000 SYN ******S*
> Oct 13 04:26:17 166.61.232.146:1540 -> xxx.yyy.1.2:4000 SYN ******S*
> Oct 13 04:26:16 166.61.232.146:1541 -> xxx.yyy.1.3:4000 SYN ******S*
> Oct 13 04:26:18 166.61.232.146:1542 -> xxx.yyy.1.4:4000 SYN ******S*
> Oct 13 04:26:18 166.61.232.146:1543 -> xxx.yyy.1.5:4000 SYN ******S*
> Oct 13 04:26:18 166.61.232.146:1545 -> xxx.yyy.1.6:4000 SYN ******S*
> Oct 13 04:26:18 166.61.232.146:1547 -> xxx.yyy.1.7:4000 SYN ******S*
> Oct 13 04:26:15 166.61.232.146:1548 -> xxx.yyy.1.8:4000 SYN ******S*
> [...]
> Oct 13 04:37:57 166.61.232.146:3992 -> xxx.yyy.255.243:4000 SYN
> ******S*
> Oct 13 04:37:57 166.61.232.146:3989 -> xxx.yyy.255.240:4000 SYN
> ******S*
> Oct 13 04:37:57 166.61.232.146:4003 -> xxx.yyy.255.254:4000 SYN
> ******S*
> Oct 13 04:37:57 166.61.232.146:4000 -> xxx.yyy.255.251:4000 SYN
> ******S*
> Oct 13 04:37:57 166.61.232.146:3997 -> xxx.yyy.255.248:4000 SYN
> ******S*
> Oct 13 04:37:57 166.61.232.146:4001 -> xxx.yyy.255.252:4000 SYN
> ******S*
> Oct 13 04:37:57 166.61.232.146:3999 -> xxx.yyy.255.250:4000 SYN
> ******S*
> Oct 13 04:37:57 166.61.232.146:3996 -> xxx.yyy.255.247:4000 SYN
> ******S*
> 69600
>
> Oct 13 07:39:32 213.66.207.126:2375 -> xxx.yyy.1.1:2277 SYN ******S*
> Oct 13 07:39:32 213.66.207.126:2377 -> xxx.yyy.1.2:2277 SYN ******S*
> Oct 13 07:39:32 213.66.207.126:2379 -> xxx.yyy.1.3:2277 SYN ******S*
> Oct 13 07:39:31 213.66.207.126:2381 -> xxx.yyy.1.4:2277 SYN ******S*
> Oct 13 07:39:34 213.66.207.126:2383 -> xxx.yyy.1.5:2277 SYN ******S*
> Oct 13 07:39:31 213.66.207.126:2385 -> xxx.yyy.1.6:2277 SYN ******S*
> Oct 13 07:39:34 213.66.207.126:2387 -> xxx.yyy.1.7:2277 SYN ******S*
> Oct 13 07:39:34 213.66.207.126:2393 -> xxx.yyy.1.10:2277 SYN ******S*
> [...]
> Oct 13 07:51:02 213.66.207.126:3104 -> xxx.yyy.255.218:2277 SYN
> ******S*
> Oct 13 07:51:03 213.66.207.126:3156 -> xxx.yyy.255.244:2277 SYN
> ******S*
> Oct 13 07:51:03 213.66.207.126:3160 -> xxx.yyy.255.246:2277 SYN
> ******S*
> Oct 13 07:51:03 213.66.207.126:3162 -> xxx.yyy.255.247:2277 SYN
> ******S*
> Oct 13 07:51:03 213.66.207.126:3164 -> xxx.yyy.255.248:2277 SYN
> ******S*
> Oct 13 07:51:03 213.66.207.126:3166 -> xxx.yyy.255.249:2277 SYN
> ******S*
> Oct 13 07:51:03 213.66.207.126:3168 -> xxx.yyy.255.250:2277 SYN
> ******S*
> Oct 13 07:51:03 213.66.207.126:3170 -> xxx.yyy.255.251:2277 SYN
> ******S*
> 67449
>
> Oct 13 07:49:14 216.247.121.37:51957 -> xxx.yyy.1.1:8000 SYN ******S*
> Oct 13 07:49:14 216.247.121.37:51958 -> xxx.yyy.1.2:8000 SYN ******S*
> Oct 13 07:49:14 216.247.121.37:51959 -> xxx.yyy.1.3:8000 SYN ******S*
> Oct 13 07:49:15 216.247.121.37:51960 -> xxx.yyy.1.4:8000 SYN ******S*
> Oct 13 07:49:15 216.247.121.37:51961 -> xxx.yyy.1.5:8000 SYN ******S*
> Oct 13 07:49:15 216.247.121.37:51962 -> xxx.yyy.1.6:8000 SYN ******S*
> Oct 13 07:49:15 216.247.121.37:51963 -> xxx.yyy.1.7:8000 SYN ******S*
> Oct 13 07:49:15 216.247.121.37:51964 -> xxx.yyy.1.8:8000 SYN ******S*
> [...]
> Oct 13 08:00:54 216.247.121.37:52754 -> xxx.yyy.255.247:8000 SYN
> ******S*
> Oct 13 08:00:54 216.247.121.37:52752 -> xxx.yyy.255.245:8000 SYN
> ******S*
> Oct 13 08:00:54 216.247.121.37:52753 -> xxx.yyy.255.246:8000 SYN
> ******S*
> Oct 13 08:00:54 216.247.121.37:52750 -> xxx.yyy.255.243:8000 SYN
> ******S*
> Oct 13 08:00:54 216.247.121.37:52761 -> xxx.yyy.255.254:8000 SYN
> ******S*
> Oct 13 08:00:54 216.247.121.37:52758 -> xxx.yyy.255.251:8000 SYN
> ******S*
> Oct 13 08:00:54 216.247.121.37:52760 -> xxx.yyy.255.253:8000 SYN
> ******S*
> Oct 13 08:00:54 216.247.121.37:52759 -> xxx.yyy.255.252:8000 SYN
> ******S*
> Oct 13 08:00:54 216.247.121.37:52757 -> xxx.yyy.255.250:8000 SYN
> ******S*
> 64327
>
> Oct 13 19:36:20 207.72.148.105:3079 -> xxx.yyy.1.0:1433 SYN ******S*
> Oct 13 19:36:20 207.72.148.105:3098 -> xxx.yyy.1.2:1433 SYN ******S*
> Oct 13 19:36:23 207.72.148.105:3111 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 19:36:23 207.72.148.105:3125 -> xxx.yyy.1.4:1433 SYN ******S*
> Oct 13 19:36:23 207.72.148.105:3149 -> xxx.yyy.1.6:1433 SYN ******S*
> Oct 13 19:36:23 207.72.148.105:3151 -> xxx.yyy.1.7:1433 SYN ******S*
> Oct 13 19:36:21 207.72.148.105:3204 -> xxx.yyy.1.12:1433 SYN ******S*
> Oct 13 19:36:21 207.72.148.105:3215 -> xxx.yyy.1.13:1433 SYN ******S*
> [...]
> Oct 13 23:21:45 207.72.148.105:4479 -> xxx.yyy.217.252:1433 SYN
> ******S*
> Oct 13 23:21:46 207.72.148.105:4452 -> xxx.yyy.218.1:1433 SYN ******S*
> Oct 13 23:21:47 207.72.148.105:3086 -> xxx.yyy.218.2:1433 SYN ******S*
> Oct 13 23:21:47 207.72.148.105:3558 -> xxx.yyy.217.253:1433 SYN
> ******S*
> Oct 13 23:21:48 207.72.148.105:3670 -> xxx.yyy.217.254:1433 SYN
> ******S*
> Oct 13 23:21:50 207.72.148.105:4339 -> xxx.yyy.218.0:1433 SYN ******S*
> Oct 13 23:21:51 207.72.148.105:4808 -> xxx.yyy.218.6:1433 SYN ******S*
> Oct 13 23:21:52 207.72.148.105:4097 -> xxx.yyy.218.4:1433 SYN ******S*
> 51867
>
> Oct 13 09:17:51 213.23.250.150:2027 -> xxx.yyy.1.1:1433 SYN ******S*
> Oct 13 09:17:48 213.23.250.150:2029 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 09:17:48 213.23.250.150:2032 -> xxx.yyy.1.4:1433 SYN ******S*
> Oct 13 09:17:48 213.23.250.150:2033 -> xxx.yyy.1.5:1433 SYN ******S*
> Oct 13 09:17:51 213.23.250.150:2035 -> xxx.yyy.1.7:1433 SYN ******S*
> Oct 13 09:17:48 213.23.250.150:2037 -> xxx.yyy.1.9:1433 SYN ******S*
> Oct 13 09:17:51 213.23.250.150:2039 -> xxx.yyy.1.10:1433 SYN ******S*
> Oct 13 09:17:51 213.23.250.150:2040 -> xxx.yyy.1.11:1433 SYN ******S*
> [...]
> Oct 13 09:29:26 213.23.250.150:1574 -> xxx.yyy.255.240:1433 SYN
> ******S*
> Oct 13 09:29:26 213.23.250.150:1575 -> xxx.yyy.255.241:1433 SYN
> ******S*
> Oct 13 09:29:26 213.23.250.150:1576 -> xxx.yyy.255.242:1433 SYN
> ******S*
> Oct 13 09:29:26 213.23.250.150:1577 -> xxx.yyy.255.243:1433 SYN
> ******S*
> Oct 13 09:29:26 213.23.250.150:1580 -> xxx.yyy.255.246:1433 SYN
> ******S*
> Oct 13 09:29:26 213.23.250.150:1584 -> xxx.yyy.255.250:1433 SYN
> ******S*
> Oct 13 09:29:26 213.23.250.150:1589 -> xxx.yyy.255.253:1433 SYN
> ******S*
> Oct 13 09:29:26 213.23.250.150:1590 -> xxx.yyy.255.254:1433 SYN
> ******S*
> 49152
>
> Oct 13 09:33:49 211.158.26.34:3528 -> xxx.yyy.1.0:1433 SYN ******S*
> Oct 13 09:33:52 211.158.26.34:3537 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 09:33:49 211.158.26.34:3558 -> xxx.yyy.1.10:1433 SYN ******S*
> Oct 13 09:33:49 211.158.26.34:3612 -> xxx.yyy.1.28:1433 SYN ******S*
> Oct 13 09:33:52 211.158.26.34:3551 -> xxx.yyy.1.8:1433 SYN ******S*
> Oct 13 09:33:50 211.158.26.34:3585 -> xxx.yyy.1.19:1433 SYN ******S*
> Oct 13 09:33:50 211.158.26.34:3594 -> xxx.yyy.1.22:1433 SYN ******S*
> Oct 13 09:33:50 211.158.26.34:3570 -> xxx.yyy.1.14:1433 SYN ******S*
> [...]
> Oct 13 13:22:37 211.158.26.34:4495 -> xxx.yyy.255.252:1433 SYN ******S*
> Oct 13 13:22:37 211.158.26.34:4065 -> xxx.yyy.255.230:1433 SYN ******S*
> Oct 13 13:22:38 211.158.26.34:4083 -> xxx.yyy.255.231:1433 SYN ******S*
> Oct 13 13:22:39 211.158.26.34:4166 -> xxx.yyy.255.239:1433 SYN ******S*
> Oct 13 13:22:39 211.158.26.34:4114 -> xxx.yyy.255.236:1433 SYN ******S*
> Oct 13 13:22:40 211.158.26.34:4243 -> xxx.yyy.255.243:1433 SYN ******S*
> Oct 13 13:22:41 211.158.26.34:4217 -> xxx.yyy.255.240:1433 SYN ******S*
> Oct 13 13:22:41 211.158.26.34:4279 -> xxx.yyy.255.245:1433 SYN ******S*
> Oct 13 13:22:42 211.158.26.34:4343 -> xxx.yyy.255.249:1433 SYN ******S*
> 39874
>
> Oct 13 03:27:25 221.148.5.253:4405 -> xxx.yyy.1.4:4899 SYN ******S*
> Oct 13 03:27:26 221.148.5.253:4404 -> xxx.yyy.1.3:4899 SYN ******S*
> Oct 13 03:27:25 221.148.5.253:4407 -> xxx.yyy.1.6:4899 SYN ******S*
> Oct 13 03:27:26 221.148.5.253:4401 -> xxx.yyy.1.1:4899 SYN ******S*
> Oct 13 03:27:26 221.148.5.253:4403 -> xxx.yyy.1.2:4899 SYN ******S*
> Oct 13 03:27:25 221.148.5.253:4406 -> xxx.yyy.1.5:4899 SYN ******S*
> Oct 13 03:27:25 221.148.5.253:4411 -> xxx.yyy.1.10:4899 SYN ******S*
> Oct 13 03:27:25 221.148.5.253:4410 -> xxx.yyy.1.9:4899 SYN ******S*
> [...]
> Oct 13 03:31:43 221.148.5.253:1364 -> xxx.yyy.255.252:4899 SYN ******S*
> Oct 13 03:31:43 221.148.5.253:1359 -> xxx.yyy.255.247:4899 SYN ******S*
> Oct 13 03:31:43 221.148.5.253:1361 -> xxx.yyy.255.249:4899 SYN ******S*
> Oct 13 03:31:43 221.148.5.253:1365 -> xxx.yyy.255.253:4899 SYN ******S*
> Oct 13 03:31:43 221.148.5.253:1366 -> xxx.yyy.255.254:4899 SYN ******S*
> Oct 13 03:31:45 221.148.5.253:1292 -> xxx.yyy.255.181:4899 SYN ******S*
> Oct 13 03:31:45 221.148.5.253:1290 -> xxx.yyy.255.179:4899 SYN ******S*
> Oct 13 03:31:45 221.148.5.253:1291 -> xxx.yyy.255.180:4899 SYN ******S*
> Oct 13 03:31:45 221.148.5.253:1289 -> xxx.yyy.255.178:4899 SYN ******S*
> 39779
>
> Oct 13 12:31:22 211.174.63.45:4916 -> xxx.yyy.1.1:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4922 -> xxx.yyy.1.2:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4929 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4937 -> xxx.yyy.1.4:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4953 -> xxx.yyy.1.6:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4975 -> xxx.yyy.1.9:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4980 -> xxx.yyy.1.10:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4990 -> xxx.yyy.1.12:1433 SYN ******S*
> [...]
> Oct 13 12:49:30 211.174.63.45:1102 -> xxx.yyy.255.236:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1122 -> xxx.yyy.255.240:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1132 -> xxx.yyy.255.242:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1152 -> xxx.yyy.255.246:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1159 -> xxx.yyy.255.247:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1169 -> xxx.yyy.255.249:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1164 -> xxx.yyy.255.248:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1174 -> xxx.yyy.255.250:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1147 -> xxx.yyy.255.245:1433 SYN ******S*
> 36982
>
> Oct 13 14:13:01 66.169.24.204:3568 -> xxx.yyy.1.5:6129 SYN ******S*
> Oct 13 14:13:01 66.169.24.204:3570 -> xxx.yyy.1.7:6129 SYN ******S*
> Oct 13 14:13:01 66.169.24.204:3573 -> xxx.yyy.1.10:6129 SYN ******S*
> Oct 13 14:13:00 66.169.24.204:3574 -> xxx.yyy.1.11:6129 SYN ******S*
> Oct 13 14:13:01 66.169.24.204:3575 -> xxx.yyy.1.12:6129 SYN ******S*
> Oct 13 14:13:01 66.169.24.204:3576 -> xxx.yyy.1.13:6129 SYN ******S*
> Oct 13 14:12:59 66.169.24.204:3580 -> xxx.yyy.1.17:6129 SYN ******S*
> Oct 13 14:12:59 66.169.24.204:3583 -> xxx.yyy.1.20:6129 SYN ******S*
> [...]
> Oct 13 14:24:07 66.169.24.204:2281 -> xxx.yyy.255.230:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2283 -> xxx.yyy.255.232:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2288 -> xxx.yyy.255.237:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2287 -> xxx.yyy.255.236:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2285 -> xxx.yyy.255.234:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2289 -> xxx.yyy.255.238:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2291 -> xxx.yyy.255.240:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2299 -> xxx.yyy.255.248:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2304 -> xxx.yyy.255.253:6129 SYN ******S*
> 35399
>
> Oct 13 21:09:15 80.79.66.4:3503 -> xxx.yyy.1.3:8000 SYN ******S*
> Oct 13 21:09:16 80.79.66.4:3504 -> xxx.yyy.1.4:8000 SYN ******S*
> Oct 13 21:09:16 80.79.66.4:3505 -> xxx.yyy.1.5:8000 SYN ******S*
> Oct 13 21:09:16 80.79.66.4:3507 -> xxx.yyy.1.7:8000 SYN ******S*
> Oct 13 21:09:13 80.79.66.4:3508 -> xxx.yyy.1.8:8000 SYN ******S*
> Oct 13 21:09:16 80.79.66.4:3510 -> xxx.yyy.1.10:8000 SYN ******S*
> Oct 13 21:09:13 80.79.66.4:3512 -> xxx.yyy.1.12:8000 SYN ******S*
> Oct 13 21:09:13 80.79.66.4:3513 -> xxx.yyy.1.13:8000 SYN ******S*
> [...]
> Oct 13 21:20:59 80.79.66.4:3233 -> xxx.yyy.255.206:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3240 -> xxx.yyy.255.213:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3243 -> xxx.yyy.255.216:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3247 -> xxx.yyy.255.220:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3245 -> xxx.yyy.255.218:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3248 -> xxx.yyy.255.221:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3252 -> xxx.yyy.255.225:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3280 -> xxx.yyy.255.253:8000 SYN ******S*
> 35324
>
> Oct 13 06:37:39 221.203.177.65:4176 -> xxx.yyy.11.224:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4180 -> xxx.yyy.11.225:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4186 -> xxx.yyy.11.226:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4189 -> xxx.yyy.11.227:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4192 -> xxx.yyy.11.228:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4195 -> xxx.yyy.11.229:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4199 -> xxx.yyy.11.230:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4202 -> xxx.yyy.11.231:1433 SYN ******S*
> [...]
> Oct 13 08:02:19 221.203.177.65:4268 -> xxx.yyy.105.233:1433 SYN
> ******S*
> Oct 13 08:02:19 221.203.177.65:4322 -> xxx.yyy.105.234:1433 SYN
> ******S*
> Oct 13 08:02:19 221.203.177.65:4349 -> xxx.yyy.105.235:1433 SYN
> ******S*
> Oct 13 08:02:19 221.203.177.65:4385 -> xxx.yyy.105.236:1433 SYN
> ******S*
> Oct 13 08:02:19 221.203.177.65:4390 -> xxx.yyy.105.237:1433 SYN
> ******S*
> Oct 13 08:02:20 221.203.177.65:4397 -> xxx.yyy.105.238:1433 SYN
> ******S*
> Oct 13 08:02:20 221.203.177.65:4410 -> xxx.yyy.105.239:1433 SYN
> ******S*
> Oct 13 08:02:20 221.203.177.65:4455 -> xxx.yyy.105.240:1433 SYN
> ******S*
> 28666
>
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.0:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.8:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.9:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.10:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.11:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.18:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.19:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.20:22 SYN ******S*
> [...]
> Oct 13 15:36:56 204.185.0.155:58585 -> xxx.yyy.220.89:22 SYN ******S*
> Oct 13 15:36:56 204.185.0.155:58589 -> xxx.yyy.236.51:22 SYN ******S*
> Oct 13 15:36:58 204.185.0.155:58632 -> xxx.yyy.220.89:22 SYN ******S*
> Oct 13 15:37:01 204.185.0.155:58703 -> xxx.yyy.236.69:22 SYN ******S*
> Oct 13 15:37:01 204.185.0.155:58728 -> xxx.yyy.236.51:22 SYN ******S*
> Oct 13 15:37:05 204.185.0.155:58823 -> xxx.yyy.220.89:22 SYN ******S*
> Oct 13 15:37:03 204.185.0.155:58780 -> xxx.yyy.236.69:22 SYN ******S*
> Oct 13 15:37:07 204.185.0.155:58887 -> xxx.yyy.236.51:22 SYN ******S*
> Oct 13 15:37:10 204.185.0.155:58961 -> xxx.yyy.236.69:22 SYN ******S*
> 27277
>
> Oct 13 12:45:47 64.247.235.248:3126 -> xxx.yyy.1.2:1433 SYN ******S*
> Oct 13 12:45:47 64.247.235.248:3127 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 12:45:47 64.247.235.248:3129 -> xxx.yyy.1.5:1433 SYN ******S*
> Oct 13 12:45:47 64.247.235.248:3130 -> xxx.yyy.1.6:1433 SYN ******S*
> Oct 13 12:45:47 64.247.235.248:3131 -> xxx.yyy.1.7:1433 SYN ******S*
> Oct 13 12:45:48 64.247.235.248:3134 -> xxx.yyy.1.10:1433 SYN ******S*
> Oct 13 12:45:48 64.247.235.248:3135 -> xxx.yyy.1.11:1433 SYN ******S*
> Oct 13 12:45:48 64.247.235.248:3140 -> xxx.yyy.1.16:1433 SYN ******S*
> [...]
> Oct 13 13:02:44 64.247.235.248:4080 -> xxx.yyy.255.240:1433 SYN
> ******S*
> Oct 13 13:02:44 64.247.235.248:4081 -> xxx.yyy.255.241:1433 SYN
> ******S*
> Oct 13 13:02:44 64.247.235.248:4086 -> xxx.yyy.255.246:1433 SYN
> ******S*
> Oct 13 13:02:44 64.247.235.248:4088 -> xxx.yyy.255.248:1433 SYN
> ******S*
> Oct 13 13:02:45 64.247.235.248:4090 -> xxx.yyy.255.250:1433 SYN
> ******S*
> Oct 13 13:02:45 64.247.235.248:4091 -> xxx.yyy.255.251:1433 SYN
> ******S*
> Oct 13 13:02:45 64.247.235.248:4092 -> xxx.yyy.255.252:1433 SYN
> ******S*
> Oct 13 13:02:45 64.247.235.248:4094 -> xxx.yyy.255.254:1433 SYN
> ******S*
> 23864
>
> Oct 13 00:00:02 82.53.78.222:3634 -> xxx.yyy.68.151:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3670 -> xxx.yyy.69.176:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3672 -> xxx.yyy.69.178:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3673 -> xxx.yyy.69.179:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3674 -> xxx.yyy.69.180:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3675 -> xxx.yyy.69.181:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3676 -> xxx.yyy.69.182:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3678 -> xxx.yyy.69.184:443 SYN ******S*
> [...]
> Oct 13 00:07:08 82.53.78.222:4076 -> xxx.yyy.241.33:443 SYN ******S*
> Oct 13 00:07:09 82.53.78.222:4079 -> xxx.yyy.241.35:443 SYN ******S*
> Oct 13 00:07:09 82.53.78.222:4080 -> xxx.yyy.241.72:443 SYN ******S*
> Oct 13 00:07:09 82.53.78.222:4083 -> xxx.yyy.241.111:443 SYN ******S*
> Oct 13 00:07:09 82.53.78.222:4084 -> xxx.yyy.241.168:443 SYN ******S*
> Oct 13 00:07:09 82.53.78.222:4085 -> xxx.yyy.241.186:443 SYN ******S*
> Oct 13 00:07:10 82.53.78.222:4088 -> xxx.yyy.243.44:443 SYN ******S*
> Oct 13 00:07:10 82.53.78.222:4093 -> xxx.yyy.244.79:443 SYN ******S*
> Oct 13 00:07:10 82.53.78.222:4094 -> xxx.yyy.248.4:443 SYN ******S*
> 21877
>
> [...]
> 10701
>
> Oct 13 10:19:09 61.111.110.38:2759 -> xxx.yyy.224.39:139 SYN ******S*
> Oct 13 10:19:09 61.111.110.38:2760 -> xxx.yyy.224.40:139 SYN ******S*
> Oct 13 10:19:06 61.111.110.38:2761 -> xxx.yyy.224.41:139 SYN ******S*
> Oct 13 10:19:09 61.111.110.38:2764 -> xxx.yyy.224.42:139 SYN ******S*
> Oct 13 10:19:06 61.111.110.38:2766 -> xxx.yyy.224.43:139 SYN ******S*
> Oct 13 10:19:09 61.111.110.38:2767 -> xxx.yyy.224.44:139 SYN ******S*
> Oct 13 10:19:09 61.111.110.38:2768 -> xxx.yyy.224.45:139 SYN ******S*
> Oct 13 10:19:09 61.111.110.38:2769 -> xxx.yyy.224.46:139 SYN ******S*
> [...]
> Oct 13 12:53:28 61.111.110.38:4763 -> xxx.yyy.251.153:139 SYN ******S*
> Oct 13 12:53:28 61.111.110.38:4764 -> xxx.yyy.251.149:139 SYN ******S*
> Oct 13 12:53:25 61.111.110.38:4767 -> xxx.yyy.251.150:139 SYN ******S*
> Oct 13 12:53:26 61.111.110.38:4864 -> xxx.yyy.251.155:139 SYN ******S*
> Oct 13 12:53:26 61.111.110.38:4979 -> xxx.yyy.251.156:139 SYN ******S*
> Oct 13 12:53:27 61.111.110.38:4748 -> xxx.yyy.251.143:139 SYN ******S*
> Oct 13 12:53:28 61.111.110.38:4757 -> xxx.yyy.251.148:139 SYN ******S*
> Oct 13 12:53:28 61.111.110.38:4846 -> xxx.yyy.251.154:139 SYN ******S*
> 9816
>
> Oct 13 12:43:02 82.226.147.97:3021 -> xxx.yyy.245.219:139 SYN ******S*
> Oct 13 12:42:59 82.226.147.97:3046 -> xxx.yyy.177.169:139 SYN ******S*
> Oct 13 12:43:01 82.226.147.97:4993 -> xxx.yyy.248.36:139 SYN ******S*
> Oct 13 12:43:02 82.226.147.97:3022 -> xxx.yyy.179.242:139 SYN ******S*
> Oct 13 12:43:02 82.226.147.97:3047 -> xxx.yyy.111.192:139 SYN ******S*
> Oct 13 12:43:09 82.226.147.97:3133 -> xxx.yyy.241.73:139 SYN ******S*
> Oct 13 12:43:09 82.226.147.97:3157 -> xxx.yyy.239.0:139 SYN ******S*
> Oct 13 12:43:09 82.226.147.97:3158 -> xxx.yyy.173.23:139 SYN ******S*
> [...]
> Oct 13 17:57:38 82.226.147.97:4120 -> xxx.yyy.206.45:139 SYN ******S*
> Oct 13 17:57:39 82.226.147.97:4218 -> xxx.yyy.15.77:139 SYN ******S*
> Oct 13 17:59:53 82.226.147.97:4856 -> xxx.yyy.77.202:139 SYN ******S*
> Oct 13 17:59:53 82.226.147.97:4848 -> xxx.yyy.131.227:139 SYN ******S*
> Oct 13 17:59:54 82.226.147.97:4885 -> xxx.yyy.226.76:139 SYN ******S*
> Oct 13 17:59:54 82.226.147.97:4892 -> xxx.yyy.1.136:139 SYN ******S*
> Oct 13 17:59:58 82.226.147.97:4958 -> xxx.yyy.149.82:139 SYN ******S*
> Oct 13 17:59:59 82.226.147.97:4963 -> xxx.yyy.153.77:139 SYN ******S*
> 9783
>
> Oct 13 00:56:49 218.168.165.81:3407 -> xxx.yyy.72.124:5554 SYN ******S*
> Oct 13 00:56:50 218.168.165.81:3536 -> xxx.yyy.72.124:1023 SYN ******S*
> Oct 13 00:56:52 218.168.165.81:3798 -> xxx.yyy.72.124:9898 SYN ******S*
> Oct 13 00:56:49 218.168.165.81:3408 -> xxx.yyy.72.125:5554 SYN ******S*
> Oct 13 00:56:50 218.168.165.81:3537 -> xxx.yyy.72.125:1023 SYN ******S*
> Oct 13 00:56:49 218.168.165.81:3409 -> xxx.yyy.72.126:5554 SYN ******S*
> Oct 13 00:56:50 218.168.165.81:3538 -> xxx.yyy.72.126:1023 SYN ******S*
> Oct 13 00:56:52 218.168.165.81:3800 -> xxx.yyy.72.126:9898 SYN ******S*
> [...]
> Oct 13 00:59:14 218.168.165.81:4300 -> xxx.yyy.74.9:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4314 -> xxx.yyy.74.23:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4319 -> xxx.yyy.74.27:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4320 -> xxx.yyy.74.29:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4321 -> xxx.yyy.74.30:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4331 -> xxx.yyy.74.40:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4336 -> xxx.yyy.74.45:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4338 -> xxx.yyy.74.47:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4351 -> xxx.yyy.74.60:9898 SYN ******S*
> 9593
>
> [...]
> 8461
>
> Oct 13 23:53:55 220.89.161.35:2111 -> xxx.yyy.235.112:5554 SYN ******S*
> Oct 13 23:53:58 220.89.161.35:3810 -> xxx.yyy.235.112:9898 SYN ******S*
> Oct 13 23:53:55 220.89.161.35:2135 -> xxx.yyy.235.114:5554 SYN ******S*
> Oct 13 23:53:56 220.89.161.35:2677 -> xxx.yyy.235.114:1023 SYN ******S*
> Oct 13 23:53:58 220.89.161.35:3941 -> xxx.yyy.235.114:9898 SYN ******S*
> Oct 13 23:53:55 220.89.161.35:2134 -> xxx.yyy.235.113:5554 SYN ******S*
> Oct 13 23:53:55 220.89.161.35:2141 -> xxx.yyy.235.116:5554 SYN ******S*
> Oct 13 23:53:56 220.89.161.35:2758 -> xxx.yyy.235.116:1023 SYN ******S*
> [...]
> Oct 13 23:54:37 220.89.161.35:1230 -> xxx.yyy.255.187:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1263 -> xxx.yyy.255.202:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1262 -> xxx.yyy.255.201:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1264 -> xxx.yyy.255.209:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1289 -> xxx.yyy.255.219:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1294 -> xxx.yyy.255.224:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1303 -> xxx.yyy.255.216:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1300 -> xxx.yyy.255.233:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1301 -> xxx.yyy.255.213:9898 SYN ******S*
> 7844
>
> Oct 13 07:22:21 61.234.149.186:3020 -> xxx.yyy.1.0:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3023 -> xxx.yyy.1.2:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3037 -> xxx.yyy.1.7:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3045 -> xxx.yyy.1.11:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3047 -> xxx.yyy.1.12:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3051 -> xxx.yyy.1.14:1433 SYN ******S*
> Oct 13 07:22:18 61.234.149.186:3057 -> xxx.yyy.1.18:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3074 -> xxx.yyy.1.25:1433 SYN ******S*
> [...]
> Oct 13 08:58:50 61.234.149.186:60374 -> xxx.yyy.107.240:1433 SYN
> ******S*
> Oct 13 08:58:51 61.234.149.186:1066 -> xxx.yyy.107.247:1433 SYN
> ******S*
> Oct 13 08:58:52 61.234.149.186:60874 -> xxx.yyy.107.215:1433 SYN
> ******S*
> Oct 13 08:58:52 61.234.149.186:65289 -> xxx.yyy.107.219:1433 SYN
> ******S*
> Oct 13 08:58:52 61.234.149.186:65322 -> xxx.yyy.107.222:1433 SYN
> ******S*
> Oct 13 08:58:54 61.234.149.186:65450 -> xxx.yyy.107.238:1433 SYN
> ******S*
> Oct 13 08:58:57 61.234.149.186:1060 -> xxx.yyy.107.245:1433 SYN
> ******S*
> Oct 13 08:58:58 61.234.149.186:60211 -> xxx.yyy.107.249:1433 SYN
> ******S*
> Oct 13 08:59:00 61.234.149.186:55905 -> xxx.yyy.107.254:1433 SYN
> ******S*
> 7019
>
> Oct 13 07:22:18 211.98.106.186:20007 -> xxx.yyy.1.4:1433 SYN ******S*
> Oct 13 07:22:18 211.98.106.186:20021 -> xxx.yyy.1.13:1433 SYN ******S*
> Oct 13 07:22:21 211.98.106.186:20026 -> xxx.yyy.1.15:1433 SYN ******S*
> Oct 13 07:22:21 211.98.106.186:20038 -> xxx.yyy.1.20:1433 SYN ******S*
> Oct 13 07:22:18 211.98.106.186:20042 -> xxx.yyy.1.22:1433 SYN ******S*
> Oct 13 07:22:21 211.98.106.186:20045 -> xxx.yyy.1.24:1433 SYN ******S*
> Oct 13 07:22:21 211.98.106.186:20086 -> xxx.yyy.1.38:1433 SYN ******S*
> Oct 13 07:22:21 211.98.106.186:20097 -> xxx.yyy.1.42:1433 SYN ******S*
> [...]
> Oct 13 08:58:49 211.98.106.186:20921 -> xxx.yyy.107.250:1433 SYN
> ******S*
> Oct 13 08:58:50 211.98.106.186:17044 -> xxx.yyy.107.239:1433 SYN
> ******S*
> Oct 13 08:58:52 211.98.106.186:15903 -> xxx.yyy.107.216:1433 SYN
> ******S*
> Oct 13 08:58:52 211.98.106.186:20723 -> xxx.yyy.107.225:1433 SYN
> ******S*
> Oct 13 08:58:54 211.98.106.186:20967 -> xxx.yyy.107.255:1433 SYN
> ******S*
> Oct 13 08:58:56 211.98.106.186:17044 -> xxx.yyy.107.239:1433 SYN
> ******S*
> Oct 13 08:58:56 211.98.106.186:20864 -> xxx.yyy.107.243:1433 SYN
> ******S*
> Oct 13 08:58:57 211.98.106.186:20873 -> xxx.yyy.107.246:1433 SYN
> ******S*
> Oct 13 08:58:58 211.98.106.186:20909 -> xxx.yyy.107.248:1433 SYN
> ******S*
> 6982
>
> [...]
> 6626
>
> Oct 13 23:57:34 222.148.19.16:2585 -> xxx.yyy.71.161:5554 SYN ******S*
> Oct 13 23:57:35 222.148.19.16:3410 -> xxx.yyy.71.161:1023 SYN ******S*
> Oct 13 23:57:37 222.148.19.16:1746 -> xxx.yyy.71.161:9898 SYN ******S*
> Oct 13 23:57:34 222.148.19.16:2603 -> xxx.yyy.71.163:5554 SYN ******S*
> Oct 13 23:57:35 222.148.19.16:3419 -> xxx.yyy.71.163:1023 SYN ******S*
> Oct 13 23:57:37 222.148.19.16:1753 -> xxx.yyy.71.163:9898 SYN ******S*
> Oct 13 23:57:34 222.148.19.16:2606 -> xxx.yyy.71.165:5554 SYN ******S*
> Oct 13 23:57:35 222.148.19.16:3426 -> xxx.yyy.71.165:1023 SYN ******S*
> [...]
> Oct 13 23:59:23 222.148.19.16:4647 -> xxx.yyy.92.16:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4609 -> xxx.yyy.92.8:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4654 -> xxx.yyy.92.18:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4641 -> xxx.yyy.92.14:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4651 -> xxx.yyy.92.17:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4703 -> xxx.yyy.92.21:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4714 -> xxx.yyy.92.25:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4713 -> xxx.yyy.92.24:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4721 -> xxx.yyy.92.26:9898 SYN ******S*
> 6170
>
> --
> - Ken
> =======================================================================
> ====
> Ken Connelly (KC152) Systems and Operations Manager, ITS - Network
> Services
> University of Northern Iowa Cedar Falls, IA
> 50614-0121
> email: Ken.Connelly at uni.edu phone: (319) 273-5850 fax: (319)
> 273-7373
> _______________________________________________
> Intrusions mailing list
> Intrusions at lists.sans.org
> http://www.dshield.org/mailman/listinfo/intrusions
>
More information about the Intrusions
mailing list