[Dshield] Bizarre Activity Spurt...

Robert Nelson nelsrob at mts.net
Mon Oct 17 21:38:38 GMT 2005


In my case, which was the start of this thread, what was strange was the
unusual burst it started arriving in - 160 or more hits within one minute,
all from the same source port; same IP for 8 hits, then a different IP for 8
more, and so on. Then it stopped for 4 hours and 13 minutes, and then
another 1 minute burst. The content would be the same old spam, however. As
mentioned in a post sent a few minutes ago, it stopped Saturday morning.

I'd not seen that furious an onslaught before, all at one blast. It usually
trickles in steadily throughout the day.

Robert

-----Original Message-----
From: list-bounces at lists.dshield.org [mailto:list-bounces at lists.dshield.org]
On Behalf Of Stephane Grobety
Sent: October 17, 2005 10:17 AM
To: General DShield Discussion List
Subject: Re: [Dshield] Bizarre Activity Spurt...


FdK> I captured a number of these packages. I received these packages on 
FdK> the following ports; the number in the second column is the count 
FdK> for Oct 16:
[snip]

What is strange about this ? All I see is messenger spam, nothing else.

-- 
Best regards,
 Stephane                            mailto:security at admin.fulgan.com




More information about the list mailing list