[Dshield] Follow Up- Interesting log entries on Netgear FR114P

Johannes Ullrich jullrich at euclidian.com
Mon Mar 17 14:59:53 GMT 2003


yes. typical scan for njabl. They operate an anti-spam blocklist and
scan machines for open procies in order to add such sites to their list.


> I received another attempt today on my Netgear Router, though from a
> familiar site (been discussed on here before), if the I.P is not spoofed,
> rt.njabl.org.
> Although I can't see why they would have scanned these ports.
> 
> Sun, 2003-03-16 08:51:36 - TCP packet - Source:209.208.0.15,29736,WAN -
> Destination:*.219.102.11,1180,LAN [Drop] - [Inbound Default rule match]

-- 
--------------------------------------------------------------------
jullrich at euclidian.com             Collaborative Intrusion Detection
                                         join http://www.dshield.org



More information about the list mailing list