[LOGS] Summary of large-scale portscanning detects

[email protected]
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]> 
The following extracts show the beginning and ending of scan activity
was detected on my network.  The number following each set is the total
number of probes for that source.  Timestamps are GMT-0500.

Aug 12 13:57:08 80.230.28.220:2668 -> xxx.yyy.1.0:1433 SYN ******S* 
Aug 12 13:57:08 80.230.28.220:2669 -> xxx.yyy.1.1:1433 SYN ******S* 
Aug 12 13:57:08 80.230.28.220:2675 -> xxx.yyy.1.2:1433 SYN ******S* 
Aug 12 13:57:08 80.230.28.220:2677 -> xxx.yyy.1.3:1433 SYN ******S* 
Aug 12 13:57:08 80.230.28.220:2679 -> xxx.yyy.1.4:1433 SYN ******S* 
Aug 12 13:57:08 80.230.28.220:2680 -> xxx.yyy.1.5:1433 SYN ******S* 
Aug 12 13:57:05 80.230.28.220:2681 -> xxx.yyy.1.6:1433 SYN ******S* 
Aug 12 13:57:08 80.230.28.220:2682 -> xxx.yyy.1.7:1433 SYN ******S* 
[...]
Aug 12 17:45:57 80.230.28.220:2573 -> xxx.yyy.255.246:1433 SYN ******S* 
Aug 12 17:45:57 80.230.28.220:2577 -> xxx.yyy.255.247:1433 SYN ******S* 
Aug 12 17:45:57 80.230.28.220:2581 -> xxx.yyy.255.248:1433 SYN ******S* 
Aug 12 17:45:57 80.230.28.220:2583 -> xxx.yyy.255.249:1433 SYN ******S* 
Aug 12 17:45:57 80.230.28.220:2585 -> xxx.yyy.255.250:1433 SYN ******S* 
Aug 12 17:45:57 80.230.28.220:2592 -> xxx.yyy.255.251:1433 SYN ******S* 
Aug 12 17:45:57 80.230.28.220:2600 -> xxx.yyy.255.252:1433 SYN ******S* 
Aug 12 17:45:57 80.230.28.220:2611 -> xxx.yyy.255.253:1433 SYN ******S* 
Aug 12 17:45:58 80.230.28.220:2622 -> xxx.yyy.255.254:1433 SYN ******S* 
121396

Aug 12 13:26:32 68.161.99.32:3528 -> xxx.yyy.1.0:1433 SYN ******S* 
Aug 12 13:26:32 68.161.99.32:3529 -> xxx.yyy.1.1:1433 SYN ******S* 
Aug 12 13:26:33 68.161.99.32:3530 -> xxx.yyy.1.2:1433 SYN ******S* 
Aug 12 13:26:33 68.161.99.32:3531 -> xxx.yyy.1.3:1433 SYN ******S* 
Aug 12 13:26:33 68.161.99.32:3532 -> xxx.yyy.1.4:1433 SYN ******S* 
Aug 12 13:26:33 68.161.99.32:3533 -> xxx.yyy.1.5:1433 SYN ******S* 
Aug 12 13:26:33 68.161.99.32:3536 -> xxx.yyy.1.6:1433 SYN ******S* 
Aug 12 13:26:33 68.161.99.32:3537 -> xxx.yyy.1.7:1433 SYN ******S* 
[...]
Aug 12 17:15:13 68.161.99.32:4623 -> xxx.yyy.255.247:1433 SYN ******S* 
Aug 12 17:15:14 68.161.99.32:4626 -> xxx.yyy.255.248:1433 SYN ******S* 
Aug 12 17:15:14 68.161.99.32:4628 -> xxx.yyy.255.249:1433 SYN ******S* 
Aug 12 17:15:14 68.161.99.32:4630 -> xxx.yyy.255.250:1433 SYN ******S* 
Aug 12 17:15:14 68.161.99.32:4631 -> xxx.yyy.255.251:1433 SYN ******S* 
Aug 12 17:15:14 68.161.99.32:4637 -> xxx.yyy.255.254:1433 SYN ******S* 
Aug 12 17:15:14 68.161.99.32:4635 -> xxx.yyy.255.253:1433 SYN ******S* 
Aug 12 17:15:14 68.161.99.32:4633 -> xxx.yyy.255.252:1433 SYN ******S* 
121302

Aug 12 12:56:42 200.119.113.138:3702 -> xxx.yyy.1.0:1433 SYN ******S* 
Aug 12 12:56:40 200.119.113.138:3708 -> xxx.yyy.1.1:1433 SYN ******S* 
Aug 12 12:56:43 200.119.113.138:3710 -> xxx.yyy.1.2:1433 SYN ******S* 
Aug 12 12:56:43 200.119.113.138:3712 -> xxx.yyy.1.4:1433 SYN ******S* 
Aug 12 12:56:43 200.119.113.138:3713 -> xxx.yyy.1.5:1433 SYN ******S* 
Aug 12 12:56:43 200.119.113.138:3719 -> xxx.yyy.1.6:1433 SYN ******S* 
Aug 12 12:56:43 200.119.113.138:3721 -> xxx.yyy.1.7:1433 SYN ******S* 
Aug 12 12:56:43 200.119.113.138:3722 -> xxx.yyy.1.8:1433 SYN ******S* 
[...]
Aug 12 16:45:29 200.119.113.138:3820 -> xxx.yyy.255.246:1433 SYN ******S* 
Aug 12 16:45:29 200.119.113.138:3833 -> xxx.yyy.255.247:1433 SYN ******S* 
Aug 12 16:45:29 200.119.113.138:3840 -> xxx.yyy.255.248:1433 SYN ******S* 
Aug 12 16:45:29 200.119.113.138:3863 -> xxx.yyy.255.249:1433 SYN ******S* 
Aug 12 16:45:30 200.119.113.138:3876 -> xxx.yyy.255.250:1433 SYN ******S* 
Aug 12 16:45:30 200.119.113.138:3887 -> xxx.yyy.255.251:1433 SYN ******S* 
Aug 12 16:45:30 200.119.113.138:3888 -> xxx.yyy.255.252:1433 SYN ******S* 
Aug 12 16:45:30 200.119.113.138:3902 -> xxx.yyy.255.253:1433 SYN ******S* 
Aug 12 16:45:30 200.119.113.138:3924 -> xxx.yyy.255.254:1433 SYN ******S* 
120743

Aug 12 11:07:29 82.36.152.72:2097 -> xxx.yyy.1.1:1433 SYN ******S* 
Aug 12 11:07:29 82.36.152.72:2096 -> xxx.yyy.1.0:1433 SYN ******S* 
Aug 12 11:07:29 82.36.152.72:2098 -> xxx.yyy.1.2:1433 SYN ******S* 
Aug 12 11:07:29 82.36.152.72:2100 -> xxx.yyy.1.3:1433 SYN ******S* 
Aug 12 11:07:29 82.36.152.72:2103 -> xxx.yyy.1.4:1433 SYN ******S* 
Aug 12 11:07:29 82.36.152.72:2106 -> xxx.yyy.1.5:1433 SYN ******S* 
Aug 12 11:07:29 82.36.152.72:2107 -> xxx.yyy.1.6:1433 SYN ******S* 
Aug 12 11:07:29 82.36.152.72:2109 -> xxx.yyy.1.7:1433 SYN ******S* 
[...]
Aug 12 14:56:18 82.36.152.72:3091 -> xxx.yyy.255.247:1433 SYN ******S* 
Aug 12 14:56:18 82.36.152.72:3097 -> xxx.yyy.255.248:1433 SYN ******S* 
Aug 12 14:56:19 82.36.152.72:3099 -> xxx.yyy.255.249:1433 SYN ******S* 
Aug 12 14:56:19 82.36.152.72:3102 -> xxx.yyy.255.252:1433 SYN ******S* 
Aug 12 14:56:19 82.36.152.72:3100 -> xxx.yyy.255.250:1433 SYN ******S* 
Aug 12 14:56:19 82.36.152.72:3101 -> xxx.yyy.255.251:1433 SYN ******S* 
Aug 12 14:56:19 82.36.152.72:3103 -> xxx.yyy.255.253:1433 SYN ******S* 
Aug 12 14:56:19 82.36.152.72:3110 -> xxx.yyy.255.254:1433 SYN ******S* 
120424

Aug 12 09:09:07 82.38.25.141:2435 -> xxx.yyy.1.144:1433 SYN ******S* 
Aug 12 09:09:08 82.38.25.141:2437 -> xxx.yyy.1.145:1433 SYN ******S* 
Aug 12 09:09:08 82.38.25.141:2439 -> xxx.yyy.1.146:1433 SYN ******S* 
Aug 12 09:09:08 82.38.25.141:2445 -> xxx.yyy.1.147:1433 SYN ******S* 
Aug 12 09:09:08 82.38.25.141:2449 -> xxx.yyy.1.148:1433 SYN ******S* 
Aug 12 09:09:08 82.38.25.141:2452 -> xxx.yyy.1.149:1433 SYN ******S* 
Aug 12 09:09:08 82.38.25.141:2454 -> xxx.yyy.1.150:1433 SYN ******S* 
Aug 12 09:09:08 82.38.25.141:2458 -> xxx.yyy.1.151:1433 SYN ******S* 
[...]
Aug 12 12:57:07 82.38.25.141:1129 -> xxx.yyy.255.246:1433 SYN ******S* 
Aug 12 12:57:07 82.38.25.141:1135 -> xxx.yyy.255.250:1433 SYN ******S* 
Aug 12 12:57:07 82.38.25.141:1134 -> xxx.yyy.255.249:1433 SYN ******S* 
Aug 12 12:57:07 82.38.25.141:1133 -> xxx.yyy.255.248:1433 SYN ******S* 
Aug 12 12:57:07 82.38.25.141:1139 -> xxx.yyy.255.251:1433 SYN ******S* 
Aug 12 12:57:07 82.38.25.141:1144 -> xxx.yyy.255.254:1433 SYN ******S* 
Aug 12 12:57:07 82.38.25.141:1143 -> xxx.yyy.255.253:1433 SYN ******S* 
Aug 12 12:57:07 82.38.25.141:1142 -> xxx.yyy.255.252:1433 SYN ******S* 
113031

Aug 12 13:52:13 82.41.145.233:3344 -> xxx.yyy.1.0:1433 SYN ******S* 
Aug 12 13:52:13 82.41.145.233:3345 -> xxx.yyy.1.1:1433 SYN ******S* 
Aug 12 13:52:13 82.41.145.233:3346 -> xxx.yyy.1.2:1433 SYN ******S* 
Aug 12 13:52:13 82.41.145.233:3347 -> xxx.yyy.1.3:1433 SYN ******S* 
Aug 12 13:52:13 82.41.145.233:3348 -> xxx.yyy.1.4:1433 SYN ******S* 
Aug 12 13:52:13 82.41.145.233:3349 -> xxx.yyy.1.5:1433 SYN ******S* 
Aug 12 13:52:13 82.41.145.233:3350 -> xxx.yyy.1.6:1433 SYN ******S* 
Aug 12 13:52:13 82.41.145.233:3351 -> xxx.yyy.1.7:1433 SYN ******S* 
[...]
Aug 12 17:40:51 82.41.145.233:2789 -> xxx.yyy.255.226:1433 SYN ******S* 
Aug 12 17:40:51 82.41.145.233:2811 -> xxx.yyy.255.227:1433 SYN ******S* 
Aug 12 17:40:51 82.41.145.233:2876 -> xxx.yyy.255.229:1433 SYN ******S* 
Aug 12 17:40:51 82.41.145.233:2873 -> xxx.yyy.255.228:1433 SYN ******S* 
Aug 12 17:40:51 82.41.145.233:2886 -> xxx.yyy.255.230:1433 SYN ******S* 
Aug 12 17:40:52 82.41.145.233:2926 -> xxx.yyy.255.235:1433 SYN ******S* 
Aug 12 17:40:52 82.41.145.233:2923 -> xxx.yyy.255.234:1433 SYN ******S* 
Aug 12 17:40:52 82.41.145.233:2922 -> xxx.yyy.255.233:1433 SYN ******S* 
Aug 12 17:40:52 82.41.145.233:2948 -> xxx.yyy.255.236:1433 SYN ******S* 
98452

Aug 12 12:31:19 80.230.29.35:4952 -> xxx.yyy.73.146:1433 SYN ******S* 
Aug 12 12:31:19 80.230.29.35:4958 -> xxx.yyy.73.147:1433 SYN ******S* 
Aug 12 12:31:19 80.230.29.35:4966 -> xxx.yyy.73.148:1433 SYN ******S* 
Aug 12 12:31:19 80.230.29.35:4970 -> xxx.yyy.73.149:1433 SYN ******S* 
Aug 12 12:31:19 80.230.29.35:4974 -> xxx.yyy.73.150:1433 SYN ******S* 
Aug 12 12:31:19 80.230.29.35:4981 -> xxx.yyy.73.151:1433 SYN ******S* 
Aug 12 12:31:20 80.230.29.35:3006 -> xxx.yyy.73.152:1433 SYN ******S* 
Aug 12 12:31:17 80.230.29.35:3013 -> xxx.yyy.73.153:1433 SYN ******S* 
[...]
Aug 12 15:03:18 80.230.29.35:4700 -> xxx.yyy.248.61:1433 SYN ******S* 
Aug 12 15:03:18 80.230.29.35:4756 -> xxx.yyy.248.69:1433 SYN ******S* 
Aug 12 15:03:18 80.230.29.35:4749 -> xxx.yyy.248.68:1433 SYN ******S* 
Aug 12 15:03:18 80.230.29.35:4804 -> xxx.yyy.248.76:1433 SYN ******S* 
Aug 12 15:03:19 80.230.29.35:4798 -> xxx.yyy.248.75:1433 SYN ******S* 
Aug 12 15:03:19 80.230.29.35:4791 -> xxx.yyy.248.74:1433 SYN ******S* 
Aug 12 15:03:19 80.230.29.35:4854 -> xxx.yyy.248.83:1433 SYN ******S* 
Aug 12 15:03:19 80.230.29.35:4847 -> xxx.yyy.248.82:1433 SYN ******S* 
Aug 12 15:03:19 80.230.29.35:4861 -> xxx.yyy.248.84:1433 SYN ******S* 
96036

Aug 12 17:56:35 82.36.48.204:4053 -> xxx.yyy.1.40:1433 SYN ******S* 
Aug 12 17:56:35 82.36.48.204:4030 -> xxx.yyy.1.39:1433 SYN ******S* 
Aug 12 17:56:32 82.36.48.204:3473 -> xxx.yyy.1.17:1433 SYN ******S* 
Aug 12 17:56:35 82.36.48.204:3412 -> xxx.yyy.1.13:1433 SYN ******S* 
Aug 12 17:56:35 82.36.48.204:3436 -> xxx.yyy.1.14:1433 SYN ******S* 
Aug 12 17:56:35 82.36.48.204:3405 -> xxx.yyy.1.12:1433 SYN ******S* 
Aug 12 17:56:33 82.36.48.204:4093 -> xxx.yyy.1.43:1433 SYN ******S* 
Aug 12 17:56:33 82.36.48.204:4085 -> xxx.yyy.1.42:1433 SYN ******S* 
[...]
Aug 12 23:03:10 82.36.48.204:4999 -> xxx.yyy.255.244:1433 SYN ******S* 
Aug 12 23:03:10 82.36.48.204:1263 -> xxx.yyy.255.246:1433 SYN ******S* 
Aug 12 23:03:10 82.36.48.204:1240 -> xxx.yyy.255.245:1433 SYN ******S* 
Aug 12 23:03:10 82.36.48.204:1268 -> xxx.yyy.255.247:1433 SYN ******S* 
Aug 12 23:03:11 82.36.48.204:1315 -> xxx.yyy.255.250:1433 SYN ******S* 
Aug 12 23:03:11 82.36.48.204:1527 -> xxx.yyy.255.251:1433 SYN ******S* 
Aug 12 23:03:12 82.36.48.204:1629 -> xxx.yyy.255.253:1433 SYN ******S* 
Aug 12 23:03:12 82.36.48.204:1696 -> xxx.yyy.255.254:1433 SYN ******S* 
75444

Aug 12 16:05:51 213.22.106.7:1604 -> xxx.yyy.1.1:1433 SYN ******S* 
Aug 12 16:05:51 213.22.106.7:1606 -> xxx.yyy.1.3:1433 SYN ******S* 
Aug 12 16:05:51 213.22.106.7:1607 -> xxx.yyy.1.4:1433 SYN ******S* 
Aug 12 16:05:51 213.22.106.7:1608 -> xxx.yyy.1.5:1433 SYN ******S* 
Aug 12 16:05:52 213.22.106.7:1609 -> xxx.yyy.1.6:1433 SYN ******S* 
Aug 12 16:05:52 213.22.106.7:1610 -> xxx.yyy.1.7:1433 SYN ******S* 
Aug 12 16:05:52 213.22.106.7:1611 -> xxx.yyy.1.8:1433 SYN ******S* 
Aug 12 16:05:52 213.22.106.7:1612 -> xxx.yyy.1.9:1433 SYN ******S* 
[...]
Aug 12 17:01:22 213.22.106.7:2922 -> xxx.yyy.255.246:1433 SYN ******S* 
Aug 12 17:01:22 213.22.106.7:2928 -> xxx.yyy.255.249:1433 SYN ******S* 
Aug 12 17:01:23 213.22.106.7:2926 -> xxx.yyy.255.248:1433 SYN ******S* 
Aug 12 17:01:23 213.22.106.7:2932 -> xxx.yyy.255.251:1433 SYN ******S* 
Aug 12 17:01:23 213.22.106.7:2930 -> xxx.yyy.255.250:1433 SYN ******S* 
Aug 12 17:01:23 213.22.106.7:2934 -> xxx.yyy.255.252:1433 SYN ******S* 
Aug 12 17:01:23 213.22.106.7:2936 -> xxx.yyy.255.253:1433 SYN ******S* 
Aug 12 17:01:23 213.22.106.7:2938 -> xxx.yyy.255.254:1433 SYN ******S* 
71732

Aug 12 22:27:35 212.209.170.126:2202 -> xxx.yyy.1.1:1433 SYN ******S* 
Aug 12 22:27:35 212.209.170.126:2204 -> xxx.yyy.1.2:1433 SYN ******S* 
Aug 12 22:27:35 212.209.170.126:2206 -> xxx.yyy.1.3:1433 SYN ******S* 
Aug 12 22:27:35 212.209.170.126:2208 -> xxx.yyy.1.4:1433 SYN ******S* 
Aug 12 22:27:35 212.209.170.126:2210 -> xxx.yyy.1.5:1433 SYN ******S* 
Aug 12 22:27:35 212.209.170.126:2212 -> xxx.yyy.1.6:1433 SYN ******S* 
Aug 12 22:27:32 212.209.170.126:2214 -> xxx.yyy.1.7:1433 SYN ******S* 
Aug 12 22:27:35 212.209.170.126:2216 -> xxx.yyy.1.8:1433 SYN ******S* 
[...]
Aug 12 22:33:51 212.209.170.126:1743 -> xxx.yyy.255.14:1433 SYN ******S* 
Aug 12 22:33:51 212.209.170.126:1760 -> xxx.yyy.255.22:1433 SYN ******S* 
Aug 12 22:33:52 212.209.170.126:2244 -> xxx.yyy.255.251:1433 SYN ******S* 
Aug 12 22:33:52 212.209.170.126:2238 -> xxx.yyy.255.249:1433 SYN ******S* 
Aug 12 22:33:52 212.209.170.126:2247 -> xxx.yyy.255.252:1433 SYN ******S* 
Aug 12 22:33:52 212.209.170.126:2241 -> xxx.yyy.255.250:1433 SYN ******S* 
Aug 12 22:33:52 212.209.170.126:2236 -> xxx.yyy.255.248:1433 SYN ******S* 
Aug 12 22:33:52 212.209.170.126:2250 -> xxx.yyy.255.253:1433 SYN ******S* 
Aug 12 22:33:52 212.209.170.126:2253 -> xxx.yyy.255.254:1433 SYN ******S* 
62026

--
- Ken
===========================================================================
Ken Connelly (KC152) Systems and Operations Manager, ITS - Network Services
University of Northern Iowa                     Cedar Falls, IA  50614-0121
email: [email protected]    phone: (319) 273-5850    fax: (319) 273-7373
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.