🚀 go-pugleaf

On Wed, 24 Dec 2003 15:30:15 UTC, "Jon Saxton" <nospam@here.com> 
wrote:
> I use a hardware NAT router to my DSL with default settings (i.e. 
> nothing exposed) and although I see 10-20 probes per day, none has 
> ever gotten through.

Within a couple of hours of writing the above, I noticed a lot of 
activity on my DSL modem.  Nothing of mine was running; the computer 
was on but idle.  Sure enough, there seemed to be a concerted 
intrusion attempt going on, directed at the Win2K VPC session I had 
running.  As soon as I shut that down, the traffic stopped.

Here is a small sample:

Wed Dec 24 11:50:43 2003 Unrecognized access from 193.109.122.5:1145 
to TCP port 407
Wed Dec 24 11:50:49 2003 Unrecognized access from 193.109.122.5:1145 
to TCP port 407
Wed Dec 24 11:50:59 2003 Unrecognized access from 193.109.122.5:2794 
to TCP port 3128
Wed Dec 24 11:51:02 2003 Unrecognized access from 193.109.122.5:2794 
to TCP port 3128
Wed Dec 24 11:51:05 2003 Unrecognized access from 193.109.122.5:2794 
to TCP port 3128
Wed Dec 24 11:52:29 2003 Unrecognized access from 193.109.122.5:3740 
to TCP port 8080
Wed Dec 24 11:52:32 2003 Unrecognized access from 193.109.122.5:3740 
to TCP port 8080
Wed Dec 24 11:53:15 2003 Unrecognized access from 193.109.122.5:1597 
to TCP port 6588
Wed Dec 24 11:53:21 2003 Unrecognized access from 193.109.122.5:1597 
to TCP port 6588
Wed Dec 24 11:53:31 2003 Unrecognized access from 193.109.122.5:3218 
to TCP port 4480
Wed Dec 24 11:53:34 2003 Unrecognized access from 193.109.122.5:3218 
to TCP port 4480
Wed Dec 24 11:54:02 2003 Unrecognized access from 193.109.122.5:4945 
to TCP port 8000
Wed Dec 24 11:54:05 2003 Unrecognized access from 193.109.122.5:4945 
to TCP port 8000
Wed Dec 24 11:54:30 2003 Unrecognized access from 64.213.56.78:1030 to
UDP port 137
Wed Dec 24 11:59:18 2003 Unrecognized access from 199.224.92.121:1027 
to UDP port 137
Wed Dec 24 12:01:40 2003 Unrecognized access from 200.78.227.10:1082 
to UDP port 137
Wed Dec 24 12:01:58 2003 Unrecognized access from 218.61.144.176:1029 
to UDP port 137
Wed Dec 24 12:02:20 2003 Unrecognized access from 218.69.192.145:1029 
to UDP port 137
Wed Dec 24 12:03:29 2003 Unrecognized access from 217.3.43.113:1032 to
UDP port 137
Wed Dec 24 12:22:20 2003 Unrecognized access from 68.54.64.252:2148 to
TCP port 17300
Wed Dec 24 12:24:06 2003 Unrecognized access from 200.151.125.22:1025 
to UDP port 137

193.109.122.5 is proxyscan.undernet.org which is an interesting name. 
The other addresses resolve to various temporary connections from 
major ISPs.

I had a look at undernet.org and there is a service called proxy 
scanner which purportedly attempts to diagnose misconfigured systems. 
If that is true then there may be nothing sinister happening here but 
in that case note that *something* on my Windows 2000 VPC client made 
contact with undernet.org without action on my part.

Bit of a worry.  Warrants more investigation.

--
Reply to: field is bogus.  Respond to
Jon Saxton <triton /at/ triton /dot/ vg> Software developer for UNIX, 
OS/2 & Windows
U.S. Agent for Triton Technologies International Ltd.
http://www.triton.vg