🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.firewalls
Article #309

Re: sub-7 - 24.112.208.13; netbus - 216.112.169.221 (Was: Smurf amplifier attacks involving 24.6.230.169, 24.8.22.81, 24.1.13...

#309
From: Spam Trap
Date: Sun, 27 Feb 2000 00:00
75 lines
4285 bytes
Here's the log  (all times are in Mountain Standard Time - Denver, CO)
- thanks! See 02/27/2000 00:07:32.816 for telnet from 210.55.37.169
(210-55-37-169.dialup.xtra.co.nz):

----- log from firewall -----
From: <log@firewall>
To: <usenetspamtrap@newsguy.com>
Subject: Log file from [firewall]
Date: Sun, 27 Feb 2000 06:49:58 -0800

WebRamp 700s 0040-100C-5ADD Log (part 1) dumped to email at 02/27/2000
07:49:56.672
02/26/2000 23:10:41.016 - 	Log successfully sent via email
02/26/2000 23:20:54.032 - 	Smurf Amplification Attack Dropped -
Source:24.8.22.81, 8, WAN - 	Destination:255.255.255.255, 8, LAN -
- 	
02/26/2000 23:38:46.032 - 	Smurf Amplification Attack Dropped -
Source:24.8.22.81, 8, WAN - 	Destination:255.255.255.255, 8, LAN -
- 	
02/26/2000 23:57:06.944 - 	Smurf Amplification Attack Dropped -
Source:24.6.230.169, 8, WAN - 	Destination:255.255.255.255, 8, LAN -
- 	
02/26/2000 23:57:34.592 - 	TCP connection dropped -
Source:207.211.168.71, 2429, WAN - 	Destination:24.x.y.z, 113, LAN
- 	'Authentication' - 	Rule 0
02/26/2000 23:58:54.704 - 	Smurf Amplification Attack Dropped -
Source:24.6.230.169, 8, WAN - 	Destination:255.255.255.255, 8, LAN -
- 	
02/27/2000 00:07:32.816 - 	TCP connection dropped -
Source:210.55.37.169, 3569, WAN - 	Destination:24.x.y.z, 23, LAN
- 	'Telnet' - 	Rule 0
02/27/2000 01:03:09.240 - 	Smurf Amplification Attack Dropped -
Source:24.8.22.81, 8, WAN - 	Destination:255.255.255.255, 8, LAN -
- 	
02/27/2000 01:09:34.192 - 	Smurf Amplification Attack Dropped -
Source:24.8.22.81, 8, WAN - 	Destination:255.255.255.255, 8, LAN -
- 	
02/27/2000 01:12:00.640 - 	Smurf Amplification Attack Dropped -
Source:24.8.22.81, 8, WAN - 	Destination:255.255.255.255, 8, LAN -
- 	
02/27/2000 01:34:56.928 - 	Sub Seven Attack Dropped -
Source:24.112.208.13, 2960, WAN - 	Destination:24.x.y.z, 1243,
LAN - 	- 	
02/27/2000 02:19:55.576 - 	TCP connection dropped -
Source:24.0.94.130, 59150, WAN - 	Destination:24.x.y.z, 119, LAN
- 	'News (NNTP)' - 	Rule 0
02/27/2000 02:21:12.240 - 	TCP connection dropped -
Source:24.0.94.130, 34241, WAN - 	Destination:24.x.y.z, 119, LAN
- 	'News (NNTP)' - 	Rule 0
02/27/2000 03:00:26.016 - 	NetBus Attack Dropped -
Source:216.112.169.221, 4126, WAN - 	Destination:24.x.y.z, 12345,
LAN - 	- 	
02/27/2000 03:17:17.832 - 	ICMP packet dropped -
Source:24.7.72.45, 3, WAN - 	Destination:24.x.y.z, 3, LAN - 	'Dest
Unreachable' - 	Rule 0
02/27/2000 06:39:11.224 - 	Smurf Amplification Attack Dropped -
Source:195.116.249.180, 8, WAN - 	Destination:207.225.104.63, 8,
WAN - 	- 	
02/27/2000 07:48:54.192 - 	Successful administrator login -
Source:192.168.1.2, LAN - 	Destination:192.168.1.251 - 	- 	
----- end log from firewall -----


On Mon, 28 Feb 2000 12:23:44 +1300, cfb <cfb_hates_@_spam_nirai.ne.jp>
wrote:

>
>Spam Trap wrote:
>>[...]
>> [...] attempted telnet
>> from 210.55.37.169 (210-55-37-169.dialup.xtra.co.nz), 
>>
>
>If you can get the logs to me, I'll make sure they end up in the 
>right hands at xtra.co.nz.
Technical Details
Message-ID: <3vgjbsol9393nnia4ulnops2lvascm38ev@4ax.com>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <t2ihbsgs62blg2tfo3qrd5cjk27qnlptai@4ax.com> <1qkibsoja0h9drp8n76umj66kcino0eqnp@4ax.com> <65qibskbbrbbejpflb3i7qc791m2f8pn1q@4ax.com> <38B9B200.1E3193A5@_spam_nirai.ne.jp>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 100e10,4940de17635e6780
X-Google-Attributes: gid100e10,public
X-Google-Thread: f922c,4940de17635e6780
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10f392,60b7cb6f8866452b
X-Google-Attributes: gid10f392,public
X-Google-Thread: fa51b,60b7cb6f8866452b
X-Google-Attributes: gidfa51b,public
X-Google-Thread: 113850,4940de17635e6780
X-Google-Attributes: gid113850,public
From: Spam Trap <usenetspamtrap@newsguy.com>
Subject: Re: sub-7 - 24.112.208.13;  netbus - 216.112.169.221 (Was: Smurf   amplifier attacks involving 24.6.230.169, 24.8.22.81, 24.1.13.39,   24.13.156.131, 24.8.18.47)
Date: 2000/02/27
Message-ID: <3vgjbsol9393nnia4ulnops2lvascm38ev@4ax.com>
X-Deja-AN: 590659970
Content-Transfer-Encoding: 7bit
References: <t2ihbsgs62blg2tfo3qrd5cjk27qnlptai@4ax.com> <1qkibsoja0h9drp8n76umj66kcino0eqnp@4ax.com> <65qibskbbrbbejpflb3i7qc791m2f8pn1q@4ax.com> <38B9B200.1E3193A5@_spam_nirai.ne.jp>
Content-Type: text/plain; charset=us-ascii
Organization: NewsGuy
Mime-Version: 1.0
Reply-To: usenetspamtrap@newsguy.com
Newsgroups: comp.security.firewalls,comp.dcom.modems.cable,cableinet.cable_modems,sdnet.cablemodems,alt.cable-tv.tci-digital