[Dshield] Strange going-on from ATT space...

Jeff Kell jeff-kell at utc.edu
Mon Dec 15 19:19:33 GMT 2003


For nearly 24 hours now I have been getting slow but steady probes from 
what appears to be 12.64.0.0/14.  The probes are from varying IPs in 
that range but ALWAYS with a source port zero, destination port 25.

I received a few hundred of these today (into a /20) but they were of 
course blocked without a capture.  I'm trying to sniff a few now, will 
report back on the content if I get a hit.

Jeff




More information about the list mailing list