[Dshield] 135 still tops

Mark Warner warner at neb.com
Tue Aug 26 16:21:02 GMT 2003

135 is still my greatest hit.  I have an added twist to my firewall 
report.  Somehow an old ip address of ours was suddenly routed by Level 3 
in the last two days.
With the new address, my 135 scans came as total range 0-255 from a single 
source.  With the single class C address i would only see short scans, no 
more than 5-10 hits from any single source.  I have traced them and seem to 
be midsouth road runner , Internet Allegiance, Inc. and a Host name: 
12-223-213-119.client.insightbb.com.  Is  most of the 135 traffic like this 
or is it just the fresh meat of a new ip that set of the scan?

More information about the list mailing list