Has anyone seen this pattern?

From: VanMeter, John (John.VanMeterat_private)
Date: Fri Oct 19 2001 - 06:13:34 PDT

  • Next message: Mike Peterson: "Trojan program"

    Interesting Pattern... if you look at the below information you can see two
    things.
    	1. All IP address start in the 199.x.x.x 
    	2. the attacks use the same 13 attempted HTTP Attacks and 14
    Suspicious URL
    The only different one was 199.111.x.x which used 26 HTTP Attacks and 26
    Suspicious URL.
    
    13 Oct 2001
    
    199.219.x.x
    			13 Attempted HTTP Attack
    	14 Suspicious URL
    
    199.104.x.x
    				13 Attempted HTTP Attack
    	14 Suspicious URL
    
    199.203.x.x
    	13 Attempted HTTP Attack
    	14 Suspicious URL
    
    199.111.x.x
    		26 Attempted HTTP Attack
    	26 Suspicious URL
    
    16 Oct 2001
    
    199.227.x.x
    	13 Attempted HTTP Attack
    	14 Suspicious URL
    
    
    Has anyone else seen this?
    Thank You, 
    John van Meter
    Security Administrator
    
    Nothing is fool-proof to a sufficiently talented fool
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Fri Oct 19 2001 - 08:36:04 PDT