[Dshield] Bizarre Activity Spurt...
nelsrob at mts.net
Mon Oct 17 21:38:38 GMT 2005
In my case, which was the start of this thread, what was strange was the
unusual burst it started arriving in - 160 or more hits within one minute,
all from the same source port; same IP for 8 hits, then a different IP for 8
more, and so on. Then it stopped for 4 hours and 13 minutes, and then
another 1 minute burst. The content would be the same old spam, however. As
mentioned in a post sent a few minutes ago, it stopped Saturday morning.
I'd not seen that furious an onslaught before, all at one blast. It usually
trickles in steadily throughout the day.
From: list-bounces at lists.dshield.org [mailto:list-bounces at lists.dshield.org]
On Behalf Of Stephane Grobety
Sent: October 17, 2005 10:17 AM
To: General DShield Discussion List
Subject: Re: [Dshield] Bizarre Activity Spurt...
FdK> I captured a number of these packages. I received these packages on
FdK> the following ports; the number in the second column is the count
FdK> for Oct 16:
What is strange about this ? All I see is messenger spam, nothing else.
Stephane mailto:security at admin.fulgan.com
More information about the list