[Dshield] increase port 53 traffic and compromised hosts
afrayer at frayernet.com
Fri Jan 23 21:28:42 GMT 2004
On Thu, 2004-01-22 at 12:52, Doug Douglass wrote:
> On Thursday 22 January 2004 07:37 am, Alan Frayer wrote:
> > Whatever you did must have helped me, too, because I have noticed a
> > decline, and yesterday the logs showed an entire day without a port 53
> > attack!
> Well, of course, I'll gladly accept the credit ;)
> I emailed host/traffic info to abuse at ev1.net each day and, while I only got
> one human response, the traffic has ceased here also. Kudos to Gina and the
> "Abuse Team" at ev1.net.
> Similar traffic from hosts outside of ev1.net (aol and qwest.net, 1 host each)
> has also ceased. Hmm???
After a two day break, the 53s are back. IPs noted include:
22.214.171.124, 126.96.36.199, 188.8.131.52, and 184.108.40.206.
This is getting tiring.
Alan Frayer,CNE,CNI,CIW CI,MCP,Net+ - afrayer at frayernet.com
Member: Independent Consultants Association (ICA)
Consultants - FREE Directory Listing - http://www.ica-assn.org
More information about the list