[Dshield] 1214 (Kazaa) multiple hits & 80 as well

Mercy Mercymail at mindspring.com
Sat Jun 22 04:40:38 GMT 2002


Thanks Ed.

It's a dynamic account.  I guess that explains it.

Thanks again.

Mercy
----- Original Message -----
From: "Ed Truitt" <ed.truitt at etee2k.net>
To: <list at dshield.org>
Sent: Friday, June 21, 2002 7:35 AM
Subject: Re: [Dshield] 1214 (Kazaa) multiple hits & 80 as well


> Does your ISP supply dynamic (DHCP) addresses, or static?  If the former,
it
> may explain (partially) your getting hit with the KaZaA probes - this is
> quite common on dynamically-allocated IPs.
>
> As far as the port 80 probes, again if the addresses are assigned
> dynamically, then it is quite possible for the same attacker to have
> different IPs.  At least one of the DSL providers has been known to change
> IPs while the machines are connected (I don't know *how* they accomplish
it,
> though.)
>
> Regards,
> -EdT.
>
> ----- Original Message -----
> From: Mercy
> To: DS mailing list
> Sent: Thursday, June 20, 2002 5:40 PM
> Subject: [Dshield] 1214 (Kazaa) multiple hits & 80 as well
>
>
> I know that port 1214 is a Kazaa port.  But, this same IP address has been
> hiting me on that port for 2 days now!  This is just from today, from the
> last time I sent my log in.
>
> Funny thing is, I don't run Kazaa or any other File Sharing utilities.
Just
> wonder what he's up to?
>
> [snip]
>
> Then..... This guy keeps scanning port 80.  The IP is very close to mine.
> Notice that the attacker's ip changes from 165.247.115.148 to
165.247.88.159
> and other 165.247.xx.xxx variations.  DO you think it is the same person?
>
> [snip]
>
> What do you guys think?
>
> Mercy
>
>
> Mercy
>
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list