[Dshield] increase port 53 traffic and compromised hosts

Alan Frayer afrayer at frayernet.com
Fri Jan 23 21:28:42 GMT 2004


On Thu, 2004-01-22 at 12:52, Doug Douglass wrote:

> On Thursday 22 January 2004 07:37 am, Alan Frayer wrote:
> > Whatever you did must have helped me, too, because I have noticed a
> > decline, and yesterday the logs showed an entire day without a port 53
> > attack!
> >
> 
> Well, of course, I'll gladly accept the credit ;)
> 
> I emailed host/traffic info to abuse at ev1.net each day and, while I only got 
> one human response, the traffic has ceased here also. Kudos to Gina and the 
> "Abuse Team" at ev1.net.
> 
> Similar traffic from hosts outside of ev1.net (aol and qwest.net, 1 host each) 
> has also ceased. Hmm???
> 


After a two day break, the 53s are back. IPs noted include:
12.29.228.14, 207.250.47.10, 168.215.198.110, and 66.192.134.10.

This is getting tiring.




________________________________________________________________________

Alan Frayer,CNE,CNI,CIW CI,MCP,Net+ - afrayer at frayernet.com 
Member: Independent Consultants Association (ICA)
Consultants - FREE Directory Listing - http://www.ica-assn.org 
 



More information about the list mailing list