[Dshield] Coordinated Sub Seven Scan ?

Daniel Gerald Kluge dkluge at acm.org
Sun Aug 11 13:25:23 GMT 2002


Ladies and Gents,
over the last 24h I've got pummeled with Sub Seven scans from all over 
the world (I see US, ARIN, APNIC and RIPE addresses).

I'm not doing more analysis on the sources since I'm away from home on 
vacation :-)

Anybody else seeing something similar?

Here is the stuff from my Sonicwall, this is a DSL Line from a small 
local ISP , all Times PST5DST.

08/10/2002 11:52:59.816 -       Sub Seven Attack Dropped -      
Source:61.98.113.186, 3350, WAN -
08/10/2002 12:56:15.656 -       Sub Seven Attack Dropped -      
Source:62.163.110.11, 3444, WAN -
08/10/2002 13:37:27.208 -       Sub Seven Attack Dropped -      
Source:212.179.192.213, 2995, WAN -
08/10/2002 14:17:47.080 -       Sub Seven Attack Dropped -      
Source:193.153.15.57, 3795, WAN -
08/10/2002 15:37:43.224 -       Sub Seven Attack Dropped -      
Source:172.177.192.39, 3695, WAN -
08/10/2002 17:23:11.704 -       Sub Seven Attack Dropped -      
Source:61.79.63.91, 1519, WAN -
08/10/2002 17:42:02.128 -       Sub Seven Attack Dropped -      
Source:24.76.49.56, 1163, WAN -
08/10/2002 18:13:01.336 -       Sub Seven Attack Dropped -      
Source:211.193.55.237, 4172, WAN -
08/10/2002 19:22:52.064 -       Sub Seven Attack Dropped -      
Source:211.187.202.133, 4594, WAN -
08/10/2002 19:01:17.768 -       Sub Seven Attack Dropped -      
Source:62.194.41.55, 3150, WAN -
08/10/2002 20:12:09.688 -       Sub Seven Attack Dropped -      
Source:141.157.177.139, 3520, WAN -
08/10/2002 20:43:13.128 -       Sub Seven Attack Dropped -      
Source:24.156.129.42, 2976, WAN -
08/10/2002 21:04:09.224 -       Sub Seven Attack Dropped -      
Source:211.106.95.197, 1407, WAN -
08/10/2002 21:40:54.448 -       Sub Seven Attack Dropped -      
Source:211.41.220.114, 2297, WAN -
08/10/2002 22:11:23.944 -       Sub Seven Attack Dropped -      
Source:211.255.248.122, 1301, WAN -
08/10/2002 22:33:05.848 -       Sub Seven Attack Dropped -      
Source:61.248.87.150, 3302, WAN -
08/10/2002 23:13:28.080 -       Sub Seven Attack Dropped -      
Source:211.217.152.170, 3693, WAN -
08/10/2002 23:37:19.832 -       Sub Seven Attack Dropped -      
Source:24.150.115.87, 2341, WAN -
08/11/2002 00:37:55.208 -       Sub Seven Attack Dropped -      
Source:211.176.167.85, 1089, WAN -




More information about the list mailing list