[Dshield] Strange going-on from ATT space...
jeff-kell at utc.edu
Mon Dec 15 19:19:33 GMT 2003
For nearly 24 hours now I have been getting slow but steady probes from
what appears to be 220.127.116.11/14. The probes are from varying IPs in
that range but ALWAYS with a source port zero, destination port 25.
I received a few hundred of these today (into a /20) but they were of
course blocked without a capture. I'm trying to sniff a few now, will
report back on the content if I get a hit.
More information about the list