[SPAM Rating - Possible] RE: [Dshield] port 80 increase

Tom Geairn tgeairn at newviewconsulting.com
Mon Dec 8 05:30:54 GMT 2003


Nothing terribly unusual (port 80 scans), but the frequency of requests
for nsiislog.dll (Windows Media Buffer Overflow) have jumped 7-8x in the
last 24 hours.  The worst offenders are from 200.35.x.x.

-G'nite

Tom

-----Original Message-----
From: list-bounces at dshield.org [mailto:list-bounces at dshield.org] On
Behalf Of Rick Klinge
Sent: Sunday, December 07, 2003 7:03 PM
To: General DShield Discussion List
Subject: [SPAM Rating - Possible] RE: [Dshield] port 80 increase

We've have an active DoS via 200.204.198.208/brazil for some unknown
reason.
4 packet flood to port 80 with consistent frequency.. sync flood?

Rick

> -----Original Message-----
> From: list-bounces at dshield.org [mailto:list-bounces at dshield.org]On
> Behalf Of Johannes B. Ullrich
> Sent: Sunday, December 07, 2003 3:44 PM
> To: list at dshield.org
> Subject: [Dshield] port 80 increase
>
>
>
> A user pointed out a significant increase in the number of sources
> scanning port 80. This is always a sign of "something bad". However,
my
> web logs don't show anything unusual.
>
> If you run a web server, please take a couple minutes and scan for
> unusual activity.
>
> --
> CTO SANS Internet Storm Center               http://isc.sans.org
> phone: (617) 786 1563
>   fax: (617) 786 1550                          jullrich at sans.org
>
>

___________________________________________________________________
Virus Scanned and Filtered by http://www.FamHost.com E-Mail System.

_______________________________________________
list mailing list
list at dshield.org
To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list





More information about the list mailing list