[Dshield] Follow Up- Interesting log entries on Netgear FR114P

Johannes Ullrich jullrich at euclidian.com
Mon Mar 17 14:59:53 GMT 2003

yes. typical scan for njabl. They operate an anti-spam blocklist and
scan machines for open procies in order to add such sites to their list.

> I received another attempt today on my Netgear Router, though from a
> familiar site (been discussed on here before), if the I.P is not spoofed,
> rt.njabl.org.
> Although I can't see why they would have scanned these ports.
> Sun, 2003-03-16 08:51:36 - TCP packet - Source:,29736,WAN -
> Destination:*.219.102.11,1180,LAN [Drop] - [Inbound Default rule match]

jullrich at euclidian.com             Collaborative Intrusion Detection
                                         join http://www.dshield.org

More information about the list mailing list