[Dshield] Increased activity

Synergy synergx at attglobal.net
Sun Aug 17 13:49:54 GMT 2003


Hullo - I'm seeing somewhat increased activity here (cox.net, in RI) 
starting last night, and to a lesser extent on Comcast systems in Kittery 
ME and Seattle WA.  There are three patterns -- one is scanning from within 
the local class-B space, but not to port 135, rather a number of ports in 
the 1000-2000 range.  Here at least these seem to come from remote port 
1025.  Second is bursts of scans from port 80 to ports in the 1145-1150 
range, from IPs that Smartwhois says belong to Akamai.  Third is scans 
alleging to come from 127.0.0.1, from port 80 to a number of ports in 
1000-2000 range.  There are also a couple of French IPs banging on port 
1026...total altogether (here in RI) is maybe 150 or so starting last night.

regds,
david

--
Synergy <synergx at attglobal.net> - 96 Bolton Ave Suite 2, Providence RI 
02908 USA
401 274-5827, cell: 401 225-5004, fax: 401 274-4944




More information about the list mailing list