Article View: comp.security.firewalls
Article #309Re: sub-7 - 24.112.208.13; netbus - 216.112.169.221 (Was: Smurf amplifier attacks involving 24.6.230.169, 24.8.22.81, 24.1.13...
From: Spam Trap
Date: Sun, 27 Feb 2000 00:00
Date: Sun, 27 Feb 2000 00:00
75 lines
4285 bytes
4285 bytes
Here's the log (all times are in Mountain Standard Time - Denver, CO) - thanks! See 02/27/2000 00:07:32.816 for telnet from 210.55.37.169 (210-55-37-169.dialup.xtra.co.nz): ----- log from firewall ----- From: <log@firewall> To: <usenetspamtrap@newsguy.com> Subject: Log file from [firewall] Date: Sun, 27 Feb 2000 06:49:58 -0800 WebRamp 700s 0040-100C-5ADD Log (part 1) dumped to email at 02/27/2000 07:49:56.672 02/26/2000 23:10:41.016 - Log successfully sent via email 02/26/2000 23:20:54.032 - Smurf Amplification Attack Dropped - Source:24.8.22.81, 8, WAN - Destination:255.255.255.255, 8, LAN - - 02/26/2000 23:38:46.032 - Smurf Amplification Attack Dropped - Source:24.8.22.81, 8, WAN - Destination:255.255.255.255, 8, LAN - - 02/26/2000 23:57:06.944 - Smurf Amplification Attack Dropped - Source:24.6.230.169, 8, WAN - Destination:255.255.255.255, 8, LAN - - 02/26/2000 23:57:34.592 - TCP connection dropped - Source:207.211.168.71, 2429, WAN - Destination:24.x.y.z, 113, LAN - 'Authentication' - Rule 0 02/26/2000 23:58:54.704 - Smurf Amplification Attack Dropped - Source:24.6.230.169, 8, WAN - Destination:255.255.255.255, 8, LAN - - 02/27/2000 00:07:32.816 - TCP connection dropped - Source:210.55.37.169, 3569, WAN - Destination:24.x.y.z, 23, LAN - 'Telnet' - Rule 0 02/27/2000 01:03:09.240 - Smurf Amplification Attack Dropped - Source:24.8.22.81, 8, WAN - Destination:255.255.255.255, 8, LAN - - 02/27/2000 01:09:34.192 - Smurf Amplification Attack Dropped - Source:24.8.22.81, 8, WAN - Destination:255.255.255.255, 8, LAN - - 02/27/2000 01:12:00.640 - Smurf Amplification Attack Dropped - Source:24.8.22.81, 8, WAN - Destination:255.255.255.255, 8, LAN - - 02/27/2000 01:34:56.928 - Sub Seven Attack Dropped - Source:24.112.208.13, 2960, WAN - Destination:24.x.y.z, 1243, LAN - - 02/27/2000 02:19:55.576 - TCP connection dropped - Source:24.0.94.130, 59150, WAN - Destination:24.x.y.z, 119, LAN - 'News (NNTP)' - Rule 0 02/27/2000 02:21:12.240 - TCP connection dropped - Source:24.0.94.130, 34241, WAN - Destination:24.x.y.z, 119, LAN - 'News (NNTP)' - Rule 0 02/27/2000 03:00:26.016 - NetBus Attack Dropped - Source:216.112.169.221, 4126, WAN - Destination:24.x.y.z, 12345, LAN - - 02/27/2000 03:17:17.832 - ICMP packet dropped - Source:24.7.72.45, 3, WAN - Destination:24.x.y.z, 3, LAN - 'Dest Unreachable' - Rule 0 02/27/2000 06:39:11.224 - Smurf Amplification Attack Dropped - Source:195.116.249.180, 8, WAN - Destination:207.225.104.63, 8, WAN - - 02/27/2000 07:48:54.192 - Successful administrator login - Source:192.168.1.2, LAN - Destination:192.168.1.251 - - ----- end log from firewall ----- On Mon, 28 Feb 2000 12:23:44 +1300, cfb <cfb_hates_@_spam_nirai.ne.jp> wrote: > >Spam Trap wrote: >>[...] >> [...] attempted telnet >> from 210.55.37.169 (210-55-37-169.dialup.xtra.co.nz), >> > >If you can get the logs to me, I'll make sure they end up in the >right hands at xtra.co.nz.
Technical Details
Message-ID:
<3vgjbsol9393nnia4ulnops2lvascm38ev@4ax.com>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<t2ihbsgs62blg2tfo3qrd5cjk27qnlptai@4ax.com> <1qkibsoja0h9drp8n76umj66kcino0eqnp@4ax.com> <65qibskbbrbbejpflb3i7qc791m2f8pn1q@4ax.com> <38B9B200.1E3193A5@_spam_nirai.ne.jp>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 100e10,4940de17635e6780 X-Google-Attributes: gid100e10,public X-Google-Thread: f922c,4940de17635e6780 X-Google-Attributes: gidf922c,public X-Google-Thread: 10f392,60b7cb6f8866452b X-Google-Attributes: gid10f392,public X-Google-Thread: fa51b,60b7cb6f8866452b X-Google-Attributes: gidfa51b,public X-Google-Thread: 113850,4940de17635e6780 X-Google-Attributes: gid113850,public From: Spam Trap <usenetspamtrap@newsguy.com> Subject: Re: sub-7 - 24.112.208.13; netbus - 216.112.169.221 (Was: Smurf amplifier attacks involving 24.6.230.169, 24.8.22.81, 24.1.13.39, 24.13.156.131, 24.8.18.47) Date: 2000/02/27 Message-ID: <3vgjbsol9393nnia4ulnops2lvascm38ev@4ax.com> X-Deja-AN: 590659970 Content-Transfer-Encoding: 7bit References: <t2ihbsgs62blg2tfo3qrd5cjk27qnlptai@4ax.com> <1qkibsoja0h9drp8n76umj66kcino0eqnp@4ax.com> <65qibskbbrbbejpflb3i7qc791m2f8pn1q@4ax.com> <38B9B200.1E3193A5@_spam_nirai.ne.jp> Content-Type: text/plain; charset=us-ascii Organization: NewsGuy Mime-Version: 1.0 Reply-To: usenetspamtrap@newsguy.com Newsgroups: comp.security.firewalls,comp.dcom.modems.cable,cableinet.cable_modems,sdnet.cablemodems,alt.cable-tv.tci-digital