Re: slow scans to random IPs on port 53 (and other ports0

From: Bryan Andersen (bryanat_private)
Date: Mon Apr 30 2001 - 19:01:09 PDT


What hit my server earlier today wasn't a slow scan.  It was rapid
and from a large number of systems.  I'd consider all of these
machines listed below compromised.  I haven't had the time to
follow up on any of these.  Being crafty one could use name servers
that allow outside queries to mount an attack like this.

Anyways times are US/Central -0500.

http://www.nerdvest.com/security/2001-04-30.ipnums.txt
http://www.nerdvest.com/security/2001-04-30.log.txt

Crist Clark wrote:
>
[much snippage]

--
|  Bryan Andersen   |   bryanat_private   |   http://www.nerdvest.com   |
| Buzzwords are like annoying little flies that deserve to be swatted. |
|   -Bryan Andersen                                                    |



This archive was generated by hypermail 2b30 : Tue May 01 2001 - 07:32:52 PDT