[Dshield] Coordinated Sub Seven Scan ?

ALEPH0 aleph0 at pacbell.net
Sun Aug 11 20:07:46 GMT 2002


Saw the same thing, perhaps more intense, on the PacBell 63.206 net (several
hosts reporting) not too long ago.  They were also distributed about as you
relate, not just the APNIC ones that are ambiently common but not too
frequent.

-----Original Message-----
From: list-admin at dshield.org [mailto:list-admin at dshield.org]On Behalf Of
Daniel Gerald Kluge
Sent: Sunday, August 11, 2002 6:25 AM
To: list at dshield.org
Subject: [Dshield] Coordinated Sub Seven Scan ?


Ladies and Gents,
over the last 24h I've got pummeled with Sub Seven scans from all over
the world (I see US, ARIN, APNIC and RIPE addresses).

I'm not doing more analysis on the sources since I'm away from home on
vacation :-)

Anybody else seeing something similar?

Here is the stuff from my Sonicwall, this is a DSL Line from a small
local ISP , all Times PST5DST.

08/10/2002 11:52:59.816 -       Sub Seven Attack Dropped -
Source:61.98.113.186, 3350, WAN -
<snip>




More information about the list mailing list