[Dshield] 1214 (Kazaa) multiple hits & 80 as well
Mercymail at mindspring.com
Sat Jun 22 04:40:38 GMT 2002
It's a dynamic account. I guess that explains it.
----- Original Message -----
From: "Ed Truitt" <ed.truitt at etee2k.net>
To: <list at dshield.org>
Sent: Friday, June 21, 2002 7:35 AM
Subject: Re: [Dshield] 1214 (Kazaa) multiple hits & 80 as well
> Does your ISP supply dynamic (DHCP) addresses, or static? If the former,
> may explain (partially) your getting hit with the KaZaA probes - this is
> quite common on dynamically-allocated IPs.
> As far as the port 80 probes, again if the addresses are assigned
> dynamically, then it is quite possible for the same attacker to have
> different IPs. At least one of the DSL providers has been known to change
> IPs while the machines are connected (I don't know *how* they accomplish
> ----- Original Message -----
> From: Mercy
> To: DS mailing list
> Sent: Thursday, June 20, 2002 5:40 PM
> Subject: [Dshield] 1214 (Kazaa) multiple hits & 80 as well
> I know that port 1214 is a Kazaa port. But, this same IP address has been
> hiting me on that port for 2 days now! This is just from today, from the
> last time I sent my log in.
> Funny thing is, I don't run Kazaa or any other File Sharing utilities.
> wonder what he's up to?
> Then..... This guy keeps scanning port 80. The IP is very close to mine.
> Notice that the attacker's ip changes from 184.108.40.206 to
> and other 165.247.xx.xxx variations. DO you think it is the same person?
> What do you guys think?
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
More information about the list