[Dshield] What is the fun of this? Daily 70 packets to 1026 and1027

Bob Savage bsavage at rnr-inc.com
Tue Mar 29 11:41:36 GMT 2005


Is it possible that he is broadcasting to many IP addresses?  Your addresses might be only one of many.

Bob Savage



-----Original Message-----
From: Freek de Kruijf [mailto:f.de.kruijf at hetnet.nl]
Sent: Monday, March 28, 2005 12:07 PM
To: General DShield Discussion List
Subject: Re: [Dshield] What is the fun of this? Daily 70 packets to 1026
and1027


On Monday 28 March 2005 17:14, Johannes B. Ullrich wrote:
> > I wonder why anybody keeps "pounding" my IP-address so consistently
> > and what the fun is of this type of "attack".
>
> This is popup spam, directed at the Windows Messaging Service (not to
> be confused with 'Microsoft Instant Messenger').
> If you don't have a firewall, you would see a popup that looks very
> much like a windows system message. The Windows Messaging Service is
> usually used to notify users about print jobs that have completed, or
> if a remote administrator is about to shut down the system. So its a
> valid service, but there is no need to expose it to the Internet.

Dear Johannes,

I know all that. However why is this during a month and a half 
continuing everyday and still continuing. I can't imagen why that 
system/spammer is not using other IP-addresses or is he simply stupid?
-- 
fr.gr.

Freek
-------------- Sponsor Message ------------------------------------
Join us at SANSFIRE 2005 in Atlanta!
The Internet Storm Center Conference.
Details: http://www.sans.org/sansfire2005

_______________________________________________
send all posts to list at lists.dshield.org
To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list