Re: [LOGS] Summary of large-scale portscanning detects

Joel Esler <[email protected]>
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]> 
What kind of script do you have that compiles this list?  Is it public?

J
On Oct 14, 2004, at 10:22 AM, [email protected] wrote:

> The following extracts show the beginning and ending of scan activity
> was detected on my network.  The number following each set is the total
> number of probes for that source.  Timestamps are GMT-0500.
>
> Oct 13 02:22:02 129.173.33.54:50004 -> xxx.yyy.1.0:6112 SYN ******S*
> Oct 13 02:22:02 129.173.33.54:50005 -> xxx.yyy.1.1:6112 SYN ******S*
> Oct 13 02:22:02 129.173.33.54:50006 -> xxx.yyy.1.2:6112 SYN ******S*
> Oct 13 02:22:02 129.173.33.54:50007 -> xxx.yyy.1.3:6112 SYN ******S*
> Oct 13 02:22:05 129.173.33.54:50008 -> xxx.yyy.1.4:6112 SYN ******S*
> Oct 13 02:22:05 129.173.33.54:50009 -> xxx.yyy.1.5:6112 SYN ******S*
> Oct 13 02:22:05 129.173.33.54:50010 -> xxx.yyy.1.6:6112 SYN ******S*
> Oct 13 02:22:05 129.173.33.54:50011 -> xxx.yyy.1.7:6112 SYN ******S*
> [...]
> Oct 13 02:48:11 129.173.33.54:49777 -> xxx.yyy.255.246:6112 SYN  
> ******S*
> Oct 13 02:48:11 129.173.33.54:49780 -> xxx.yyy.255.249:6112 SYN  
> ******S*
> Oct 13 02:48:11 129.173.33.54:49779 -> xxx.yyy.255.248:6112 SYN  
> ******S*
> Oct 13 02:48:11 129.173.33.54:49781 -> xxx.yyy.255.250:6112 SYN  
> ******S*
> Oct 13 02:48:12 129.173.33.54:49782 -> xxx.yyy.255.251:6112 SYN  
> ******S*
> Oct 13 02:48:12 129.173.33.54:49783 -> xxx.yyy.255.252:6112 SYN  
> ******S*
> Oct 13 02:48:12 129.173.33.54:49784 -> xxx.yyy.255.253:6112 SYN  
> ******S*
> Oct 13 02:48:12 129.173.33.54:49785 -> xxx.yyy.255.254:6112 SYN  
> ******S*
> 74543
>
> Oct 13 06:01:57 192.216.213.250:3788 -> xxx.yyy.1.1:1433 SYN ******S*
> Oct 13 06:01:57 192.216.213.250:3789 -> xxx.yyy.1.2:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3790 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3791 -> xxx.yyy.1.4:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3792 -> xxx.yyy.1.5:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3793 -> xxx.yyy.1.6:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3794 -> xxx.yyy.1.7:1433 SYN ******S*
> Oct 13 06:02:00 192.216.213.250:3795 -> xxx.yyy.1.8:1433 SYN ******S*
> [...]
> Oct 13 06:13:55 192.216.213.250:2554 -> xxx.yyy.255.246:1433 SYN  
> ******S*
> Oct 13 06:13:55 192.216.213.250:2558 -> xxx.yyy.255.250:1433 SYN  
> ******S*
> Oct 13 06:13:55 192.216.213.250:2555 -> xxx.yyy.255.247:1433 SYN  
> ******S*
> Oct 13 06:13:55 192.216.213.250:2552 -> xxx.yyy.255.244:1433 SYN  
> ******S*
> Oct 13 06:13:55 192.216.213.250:2559 -> xxx.yyy.255.251:1433 SYN  
> ******S*
> Oct 13 06:13:55 192.216.213.250:2556 -> xxx.yyy.255.248:1433 SYN  
> ******S*
> Oct 13 06:13:55 192.216.213.250:2553 -> xxx.yyy.255.245:1433 SYN  
> ******S*
> Oct 13 06:13:55 192.216.213.250:2561 -> xxx.yyy.255.253:1433 SYN  
> ******S*
> Oct 13 06:13:55 192.216.213.250:2562 -> xxx.yyy.255.254:1433 SYN  
> ******S*
> 70712
>
> Oct 13 04:26:16 166.61.232.146:1539 -> xxx.yyy.1.1:4000 SYN ******S*
> Oct 13 04:26:17 166.61.232.146:1540 -> xxx.yyy.1.2:4000 SYN ******S*
> Oct 13 04:26:16 166.61.232.146:1541 -> xxx.yyy.1.3:4000 SYN ******S*
> Oct 13 04:26:18 166.61.232.146:1542 -> xxx.yyy.1.4:4000 SYN ******S*
> Oct 13 04:26:18 166.61.232.146:1543 -> xxx.yyy.1.5:4000 SYN ******S*
> Oct 13 04:26:18 166.61.232.146:1545 -> xxx.yyy.1.6:4000 SYN ******S*
> Oct 13 04:26:18 166.61.232.146:1547 -> xxx.yyy.1.7:4000 SYN ******S*
> Oct 13 04:26:15 166.61.232.146:1548 -> xxx.yyy.1.8:4000 SYN ******S*
> [...]
> Oct 13 04:37:57 166.61.232.146:3992 -> xxx.yyy.255.243:4000 SYN  
> ******S*
> Oct 13 04:37:57 166.61.232.146:3989 -> xxx.yyy.255.240:4000 SYN  
> ******S*
> Oct 13 04:37:57 166.61.232.146:4003 -> xxx.yyy.255.254:4000 SYN  
> ******S*
> Oct 13 04:37:57 166.61.232.146:4000 -> xxx.yyy.255.251:4000 SYN  
> ******S*
> Oct 13 04:37:57 166.61.232.146:3997 -> xxx.yyy.255.248:4000 SYN  
> ******S*
> Oct 13 04:37:57 166.61.232.146:4001 -> xxx.yyy.255.252:4000 SYN  
> ******S*
> Oct 13 04:37:57 166.61.232.146:3999 -> xxx.yyy.255.250:4000 SYN  
> ******S*
> Oct 13 04:37:57 166.61.232.146:3996 -> xxx.yyy.255.247:4000 SYN  
> ******S*
> 69600
>
> Oct 13 07:39:32 213.66.207.126:2375 -> xxx.yyy.1.1:2277 SYN ******S*
> Oct 13 07:39:32 213.66.207.126:2377 -> xxx.yyy.1.2:2277 SYN ******S*
> Oct 13 07:39:32 213.66.207.126:2379 -> xxx.yyy.1.3:2277 SYN ******S*
> Oct 13 07:39:31 213.66.207.126:2381 -> xxx.yyy.1.4:2277 SYN ******S*
> Oct 13 07:39:34 213.66.207.126:2383 -> xxx.yyy.1.5:2277 SYN ******S*
> Oct 13 07:39:31 213.66.207.126:2385 -> xxx.yyy.1.6:2277 SYN ******S*
> Oct 13 07:39:34 213.66.207.126:2387 -> xxx.yyy.1.7:2277 SYN ******S*
> Oct 13 07:39:34 213.66.207.126:2393 -> xxx.yyy.1.10:2277 SYN ******S*
> [...]
> Oct 13 07:51:02 213.66.207.126:3104 -> xxx.yyy.255.218:2277 SYN  
> ******S*
> Oct 13 07:51:03 213.66.207.126:3156 -> xxx.yyy.255.244:2277 SYN  
> ******S*
> Oct 13 07:51:03 213.66.207.126:3160 -> xxx.yyy.255.246:2277 SYN  
> ******S*
> Oct 13 07:51:03 213.66.207.126:3162 -> xxx.yyy.255.247:2277 SYN  
> ******S*
> Oct 13 07:51:03 213.66.207.126:3164 -> xxx.yyy.255.248:2277 SYN  
> ******S*
> Oct 13 07:51:03 213.66.207.126:3166 -> xxx.yyy.255.249:2277 SYN  
> ******S*
> Oct 13 07:51:03 213.66.207.126:3168 -> xxx.yyy.255.250:2277 SYN  
> ******S*
> Oct 13 07:51:03 213.66.207.126:3170 -> xxx.yyy.255.251:2277 SYN  
> ******S*
> 67449
>
> Oct 13 07:49:14 216.247.121.37:51957 -> xxx.yyy.1.1:8000 SYN ******S*
> Oct 13 07:49:14 216.247.121.37:51958 -> xxx.yyy.1.2:8000 SYN ******S*
> Oct 13 07:49:14 216.247.121.37:51959 -> xxx.yyy.1.3:8000 SYN ******S*
> Oct 13 07:49:15 216.247.121.37:51960 -> xxx.yyy.1.4:8000 SYN ******S*
> Oct 13 07:49:15 216.247.121.37:51961 -> xxx.yyy.1.5:8000 SYN ******S*
> Oct 13 07:49:15 216.247.121.37:51962 -> xxx.yyy.1.6:8000 SYN ******S*
> Oct 13 07:49:15 216.247.121.37:51963 -> xxx.yyy.1.7:8000 SYN ******S*
> Oct 13 07:49:15 216.247.121.37:51964 -> xxx.yyy.1.8:8000 SYN ******S*
> [...]
> Oct 13 08:00:54 216.247.121.37:52754 -> xxx.yyy.255.247:8000 SYN  
> ******S*
> Oct 13 08:00:54 216.247.121.37:52752 -> xxx.yyy.255.245:8000 SYN  
> ******S*
> Oct 13 08:00:54 216.247.121.37:52753 -> xxx.yyy.255.246:8000 SYN  
> ******S*
> Oct 13 08:00:54 216.247.121.37:52750 -> xxx.yyy.255.243:8000 SYN  
> ******S*
> Oct 13 08:00:54 216.247.121.37:52761 -> xxx.yyy.255.254:8000 SYN  
> ******S*
> Oct 13 08:00:54 216.247.121.37:52758 -> xxx.yyy.255.251:8000 SYN  
> ******S*
> Oct 13 08:00:54 216.247.121.37:52760 -> xxx.yyy.255.253:8000 SYN  
> ******S*
> Oct 13 08:00:54 216.247.121.37:52759 -> xxx.yyy.255.252:8000 SYN  
> ******S*
> Oct 13 08:00:54 216.247.121.37:52757 -> xxx.yyy.255.250:8000 SYN  
> ******S*
> 64327
>
> Oct 13 19:36:20 207.72.148.105:3079 -> xxx.yyy.1.0:1433 SYN ******S*
> Oct 13 19:36:20 207.72.148.105:3098 -> xxx.yyy.1.2:1433 SYN ******S*
> Oct 13 19:36:23 207.72.148.105:3111 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 19:36:23 207.72.148.105:3125 -> xxx.yyy.1.4:1433 SYN ******S*
> Oct 13 19:36:23 207.72.148.105:3149 -> xxx.yyy.1.6:1433 SYN ******S*
> Oct 13 19:36:23 207.72.148.105:3151 -> xxx.yyy.1.7:1433 SYN ******S*
> Oct 13 19:36:21 207.72.148.105:3204 -> xxx.yyy.1.12:1433 SYN ******S*
> Oct 13 19:36:21 207.72.148.105:3215 -> xxx.yyy.1.13:1433 SYN ******S*
> [...]
> Oct 13 23:21:45 207.72.148.105:4479 -> xxx.yyy.217.252:1433 SYN  
> ******S*
> Oct 13 23:21:46 207.72.148.105:4452 -> xxx.yyy.218.1:1433 SYN ******S*
> Oct 13 23:21:47 207.72.148.105:3086 -> xxx.yyy.218.2:1433 SYN ******S*
> Oct 13 23:21:47 207.72.148.105:3558 -> xxx.yyy.217.253:1433 SYN  
> ******S*
> Oct 13 23:21:48 207.72.148.105:3670 -> xxx.yyy.217.254:1433 SYN  
> ******S*
> Oct 13 23:21:50 207.72.148.105:4339 -> xxx.yyy.218.0:1433 SYN ******S*
> Oct 13 23:21:51 207.72.148.105:4808 -> xxx.yyy.218.6:1433 SYN ******S*
> Oct 13 23:21:52 207.72.148.105:4097 -> xxx.yyy.218.4:1433 SYN ******S*
> 51867
>
> Oct 13 09:17:51 213.23.250.150:2027 -> xxx.yyy.1.1:1433 SYN ******S*
> Oct 13 09:17:48 213.23.250.150:2029 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 09:17:48 213.23.250.150:2032 -> xxx.yyy.1.4:1433 SYN ******S*
> Oct 13 09:17:48 213.23.250.150:2033 -> xxx.yyy.1.5:1433 SYN ******S*
> Oct 13 09:17:51 213.23.250.150:2035 -> xxx.yyy.1.7:1433 SYN ******S*
> Oct 13 09:17:48 213.23.250.150:2037 -> xxx.yyy.1.9:1433 SYN ******S*
> Oct 13 09:17:51 213.23.250.150:2039 -> xxx.yyy.1.10:1433 SYN ******S*
> Oct 13 09:17:51 213.23.250.150:2040 -> xxx.yyy.1.11:1433 SYN ******S*
> [...]
> Oct 13 09:29:26 213.23.250.150:1574 -> xxx.yyy.255.240:1433 SYN  
> ******S*
> Oct 13 09:29:26 213.23.250.150:1575 -> xxx.yyy.255.241:1433 SYN  
> ******S*
> Oct 13 09:29:26 213.23.250.150:1576 -> xxx.yyy.255.242:1433 SYN  
> ******S*
> Oct 13 09:29:26 213.23.250.150:1577 -> xxx.yyy.255.243:1433 SYN  
> ******S*
> Oct 13 09:29:26 213.23.250.150:1580 -> xxx.yyy.255.246:1433 SYN  
> ******S*
> Oct 13 09:29:26 213.23.250.150:1584 -> xxx.yyy.255.250:1433 SYN  
> ******S*
> Oct 13 09:29:26 213.23.250.150:1589 -> xxx.yyy.255.253:1433 SYN  
> ******S*
> Oct 13 09:29:26 213.23.250.150:1590 -> xxx.yyy.255.254:1433 SYN  
> ******S*
> 49152
>
> Oct 13 09:33:49 211.158.26.34:3528 -> xxx.yyy.1.0:1433 SYN ******S*
> Oct 13 09:33:52 211.158.26.34:3537 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 09:33:49 211.158.26.34:3558 -> xxx.yyy.1.10:1433 SYN ******S*
> Oct 13 09:33:49 211.158.26.34:3612 -> xxx.yyy.1.28:1433 SYN ******S*
> Oct 13 09:33:52 211.158.26.34:3551 -> xxx.yyy.1.8:1433 SYN ******S*
> Oct 13 09:33:50 211.158.26.34:3585 -> xxx.yyy.1.19:1433 SYN ******S*
> Oct 13 09:33:50 211.158.26.34:3594 -> xxx.yyy.1.22:1433 SYN ******S*
> Oct 13 09:33:50 211.158.26.34:3570 -> xxx.yyy.1.14:1433 SYN ******S*
> [...]
> Oct 13 13:22:37 211.158.26.34:4495 -> xxx.yyy.255.252:1433 SYN ******S*
> Oct 13 13:22:37 211.158.26.34:4065 -> xxx.yyy.255.230:1433 SYN ******S*
> Oct 13 13:22:38 211.158.26.34:4083 -> xxx.yyy.255.231:1433 SYN ******S*
> Oct 13 13:22:39 211.158.26.34:4166 -> xxx.yyy.255.239:1433 SYN ******S*
> Oct 13 13:22:39 211.158.26.34:4114 -> xxx.yyy.255.236:1433 SYN ******S*
> Oct 13 13:22:40 211.158.26.34:4243 -> xxx.yyy.255.243:1433 SYN ******S*
> Oct 13 13:22:41 211.158.26.34:4217 -> xxx.yyy.255.240:1433 SYN ******S*
> Oct 13 13:22:41 211.158.26.34:4279 -> xxx.yyy.255.245:1433 SYN ******S*
> Oct 13 13:22:42 211.158.26.34:4343 -> xxx.yyy.255.249:1433 SYN ******S*
> 39874
>
> Oct 13 03:27:25 221.148.5.253:4405 -> xxx.yyy.1.4:4899 SYN ******S*
> Oct 13 03:27:26 221.148.5.253:4404 -> xxx.yyy.1.3:4899 SYN ******S*
> Oct 13 03:27:25 221.148.5.253:4407 -> xxx.yyy.1.6:4899 SYN ******S*
> Oct 13 03:27:26 221.148.5.253:4401 -> xxx.yyy.1.1:4899 SYN ******S*
> Oct 13 03:27:26 221.148.5.253:4403 -> xxx.yyy.1.2:4899 SYN ******S*
> Oct 13 03:27:25 221.148.5.253:4406 -> xxx.yyy.1.5:4899 SYN ******S*
> Oct 13 03:27:25 221.148.5.253:4411 -> xxx.yyy.1.10:4899 SYN ******S*
> Oct 13 03:27:25 221.148.5.253:4410 -> xxx.yyy.1.9:4899 SYN ******S*
> [...]
> Oct 13 03:31:43 221.148.5.253:1364 -> xxx.yyy.255.252:4899 SYN ******S*
> Oct 13 03:31:43 221.148.5.253:1359 -> xxx.yyy.255.247:4899 SYN ******S*
> Oct 13 03:31:43 221.148.5.253:1361 -> xxx.yyy.255.249:4899 SYN ******S*
> Oct 13 03:31:43 221.148.5.253:1365 -> xxx.yyy.255.253:4899 SYN ******S*
> Oct 13 03:31:43 221.148.5.253:1366 -> xxx.yyy.255.254:4899 SYN ******S*
> Oct 13 03:31:45 221.148.5.253:1292 -> xxx.yyy.255.181:4899 SYN ******S*
> Oct 13 03:31:45 221.148.5.253:1290 -> xxx.yyy.255.179:4899 SYN ******S*
> Oct 13 03:31:45 221.148.5.253:1291 -> xxx.yyy.255.180:4899 SYN ******S*
> Oct 13 03:31:45 221.148.5.253:1289 -> xxx.yyy.255.178:4899 SYN ******S*
> 39779
>
> Oct 13 12:31:22 211.174.63.45:4916 -> xxx.yyy.1.1:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4922 -> xxx.yyy.1.2:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4929 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4937 -> xxx.yyy.1.4:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4953 -> xxx.yyy.1.6:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4975 -> xxx.yyy.1.9:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4980 -> xxx.yyy.1.10:1433 SYN ******S*
> Oct 13 12:31:22 211.174.63.45:4990 -> xxx.yyy.1.12:1433 SYN ******S*
> [...]
> Oct 13 12:49:30 211.174.63.45:1102 -> xxx.yyy.255.236:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1122 -> xxx.yyy.255.240:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1132 -> xxx.yyy.255.242:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1152 -> xxx.yyy.255.246:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1159 -> xxx.yyy.255.247:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1169 -> xxx.yyy.255.249:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1164 -> xxx.yyy.255.248:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1174 -> xxx.yyy.255.250:1433 SYN ******S*
> Oct 13 12:49:30 211.174.63.45:1147 -> xxx.yyy.255.245:1433 SYN ******S*
> 36982
>
> Oct 13 14:13:01 66.169.24.204:3568 -> xxx.yyy.1.5:6129 SYN ******S*
> Oct 13 14:13:01 66.169.24.204:3570 -> xxx.yyy.1.7:6129 SYN ******S*
> Oct 13 14:13:01 66.169.24.204:3573 -> xxx.yyy.1.10:6129 SYN ******S*
> Oct 13 14:13:00 66.169.24.204:3574 -> xxx.yyy.1.11:6129 SYN ******S*
> Oct 13 14:13:01 66.169.24.204:3575 -> xxx.yyy.1.12:6129 SYN ******S*
> Oct 13 14:13:01 66.169.24.204:3576 -> xxx.yyy.1.13:6129 SYN ******S*
> Oct 13 14:12:59 66.169.24.204:3580 -> xxx.yyy.1.17:6129 SYN ******S*
> Oct 13 14:12:59 66.169.24.204:3583 -> xxx.yyy.1.20:6129 SYN ******S*
> [...]
> Oct 13 14:24:07 66.169.24.204:2281 -> xxx.yyy.255.230:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2283 -> xxx.yyy.255.232:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2288 -> xxx.yyy.255.237:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2287 -> xxx.yyy.255.236:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2285 -> xxx.yyy.255.234:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2289 -> xxx.yyy.255.238:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2291 -> xxx.yyy.255.240:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2299 -> xxx.yyy.255.248:6129 SYN ******S*
> Oct 13 14:24:07 66.169.24.204:2304 -> xxx.yyy.255.253:6129 SYN ******S*
> 35399
>
> Oct 13 21:09:15 80.79.66.4:3503 -> xxx.yyy.1.3:8000 SYN ******S*
> Oct 13 21:09:16 80.79.66.4:3504 -> xxx.yyy.1.4:8000 SYN ******S*
> Oct 13 21:09:16 80.79.66.4:3505 -> xxx.yyy.1.5:8000 SYN ******S*
> Oct 13 21:09:16 80.79.66.4:3507 -> xxx.yyy.1.7:8000 SYN ******S*
> Oct 13 21:09:13 80.79.66.4:3508 -> xxx.yyy.1.8:8000 SYN ******S*
> Oct 13 21:09:16 80.79.66.4:3510 -> xxx.yyy.1.10:8000 SYN ******S*
> Oct 13 21:09:13 80.79.66.4:3512 -> xxx.yyy.1.12:8000 SYN ******S*
> Oct 13 21:09:13 80.79.66.4:3513 -> xxx.yyy.1.13:8000 SYN ******S*
> [...]
> Oct 13 21:20:59 80.79.66.4:3233 -> xxx.yyy.255.206:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3240 -> xxx.yyy.255.213:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3243 -> xxx.yyy.255.216:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3247 -> xxx.yyy.255.220:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3245 -> xxx.yyy.255.218:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3248 -> xxx.yyy.255.221:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3252 -> xxx.yyy.255.225:8000 SYN ******S*
> Oct 13 21:20:59 80.79.66.4:3280 -> xxx.yyy.255.253:8000 SYN ******S*
> 35324
>
> Oct 13 06:37:39 221.203.177.65:4176 -> xxx.yyy.11.224:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4180 -> xxx.yyy.11.225:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4186 -> xxx.yyy.11.226:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4189 -> xxx.yyy.11.227:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4192 -> xxx.yyy.11.228:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4195 -> xxx.yyy.11.229:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4199 -> xxx.yyy.11.230:1433 SYN ******S*
> Oct 13 06:37:39 221.203.177.65:4202 -> xxx.yyy.11.231:1433 SYN ******S*
> [...]
> Oct 13 08:02:19 221.203.177.65:4268 -> xxx.yyy.105.233:1433 SYN  
> ******S*
> Oct 13 08:02:19 221.203.177.65:4322 -> xxx.yyy.105.234:1433 SYN  
> ******S*
> Oct 13 08:02:19 221.203.177.65:4349 -> xxx.yyy.105.235:1433 SYN  
> ******S*
> Oct 13 08:02:19 221.203.177.65:4385 -> xxx.yyy.105.236:1433 SYN  
> ******S*
> Oct 13 08:02:19 221.203.177.65:4390 -> xxx.yyy.105.237:1433 SYN  
> ******S*
> Oct 13 08:02:20 221.203.177.65:4397 -> xxx.yyy.105.238:1433 SYN  
> ******S*
> Oct 13 08:02:20 221.203.177.65:4410 -> xxx.yyy.105.239:1433 SYN  
> ******S*
> Oct 13 08:02:20 221.203.177.65:4455 -> xxx.yyy.105.240:1433 SYN  
> ******S*
> 28666
>
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.0:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.8:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.9:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.10:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.11:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.18:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.19:22 SYN ******S*
> Oct 13 14:52:59 204.185.0.155:14617 -> xxx.yyy.1.20:22 SYN ******S*
> [...]
> Oct 13 15:36:56 204.185.0.155:58585 -> xxx.yyy.220.89:22 SYN ******S*
> Oct 13 15:36:56 204.185.0.155:58589 -> xxx.yyy.236.51:22 SYN ******S*
> Oct 13 15:36:58 204.185.0.155:58632 -> xxx.yyy.220.89:22 SYN ******S*
> Oct 13 15:37:01 204.185.0.155:58703 -> xxx.yyy.236.69:22 SYN ******S*
> Oct 13 15:37:01 204.185.0.155:58728 -> xxx.yyy.236.51:22 SYN ******S*
> Oct 13 15:37:05 204.185.0.155:58823 -> xxx.yyy.220.89:22 SYN ******S*
> Oct 13 15:37:03 204.185.0.155:58780 -> xxx.yyy.236.69:22 SYN ******S*
> Oct 13 15:37:07 204.185.0.155:58887 -> xxx.yyy.236.51:22 SYN ******S*
> Oct 13 15:37:10 204.185.0.155:58961 -> xxx.yyy.236.69:22 SYN ******S*
> 27277
>
> Oct 13 12:45:47 64.247.235.248:3126 -> xxx.yyy.1.2:1433 SYN ******S*
> Oct 13 12:45:47 64.247.235.248:3127 -> xxx.yyy.1.3:1433 SYN ******S*
> Oct 13 12:45:47 64.247.235.248:3129 -> xxx.yyy.1.5:1433 SYN ******S*
> Oct 13 12:45:47 64.247.235.248:3130 -> xxx.yyy.1.6:1433 SYN ******S*
> Oct 13 12:45:47 64.247.235.248:3131 -> xxx.yyy.1.7:1433 SYN ******S*
> Oct 13 12:45:48 64.247.235.248:3134 -> xxx.yyy.1.10:1433 SYN ******S*
> Oct 13 12:45:48 64.247.235.248:3135 -> xxx.yyy.1.11:1433 SYN ******S*
> Oct 13 12:45:48 64.247.235.248:3140 -> xxx.yyy.1.16:1433 SYN ******S*
> [...]
> Oct 13 13:02:44 64.247.235.248:4080 -> xxx.yyy.255.240:1433 SYN  
> ******S*
> Oct 13 13:02:44 64.247.235.248:4081 -> xxx.yyy.255.241:1433 SYN  
> ******S*
> Oct 13 13:02:44 64.247.235.248:4086 -> xxx.yyy.255.246:1433 SYN  
> ******S*
> Oct 13 13:02:44 64.247.235.248:4088 -> xxx.yyy.255.248:1433 SYN  
> ******S*
> Oct 13 13:02:45 64.247.235.248:4090 -> xxx.yyy.255.250:1433 SYN  
> ******S*
> Oct 13 13:02:45 64.247.235.248:4091 -> xxx.yyy.255.251:1433 SYN  
> ******S*
> Oct 13 13:02:45 64.247.235.248:4092 -> xxx.yyy.255.252:1433 SYN  
> ******S*
> Oct 13 13:02:45 64.247.235.248:4094 -> xxx.yyy.255.254:1433 SYN  
> ******S*
> 23864
>
> Oct 13 00:00:02 82.53.78.222:3634 -> xxx.yyy.68.151:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3670 -> xxx.yyy.69.176:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3672 -> xxx.yyy.69.178:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3673 -> xxx.yyy.69.179:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3674 -> xxx.yyy.69.180:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3675 -> xxx.yyy.69.181:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3676 -> xxx.yyy.69.182:443 SYN ******S*
> Oct 13 00:00:04 82.53.78.222:3678 -> xxx.yyy.69.184:443 SYN ******S*
> [...]
> Oct 13 00:07:08 82.53.78.222:4076 -> xxx.yyy.241.33:443 SYN ******S*
> Oct 13 00:07:09 82.53.78.222:4079 -> xxx.yyy.241.35:443 SYN ******S*
> Oct 13 00:07:09 82.53.78.222:4080 -> xxx.yyy.241.72:443 SYN ******S*
> Oct 13 00:07:09 82.53.78.222:4083 -> xxx.yyy.241.111:443 SYN ******S*
> Oct 13 00:07:09 82.53.78.222:4084 -> xxx.yyy.241.168:443 SYN ******S*
> Oct 13 00:07:09 82.53.78.222:4085 -> xxx.yyy.241.186:443 SYN ******S*
> Oct 13 00:07:10 82.53.78.222:4088 -> xxx.yyy.243.44:443 SYN ******S*
> Oct 13 00:07:10 82.53.78.222:4093 -> xxx.yyy.244.79:443 SYN ******S*
> Oct 13 00:07:10 82.53.78.222:4094 -> xxx.yyy.248.4:443 SYN ******S*
> 21877
>
> [...]
> 10701
>
> Oct 13 10:19:09 61.111.110.38:2759 -> xxx.yyy.224.39:139 SYN ******S*
> Oct 13 10:19:09 61.111.110.38:2760 -> xxx.yyy.224.40:139 SYN ******S*
> Oct 13 10:19:06 61.111.110.38:2761 -> xxx.yyy.224.41:139 SYN ******S*
> Oct 13 10:19:09 61.111.110.38:2764 -> xxx.yyy.224.42:139 SYN ******S*
> Oct 13 10:19:06 61.111.110.38:2766 -> xxx.yyy.224.43:139 SYN ******S*
> Oct 13 10:19:09 61.111.110.38:2767 -> xxx.yyy.224.44:139 SYN ******S*
> Oct 13 10:19:09 61.111.110.38:2768 -> xxx.yyy.224.45:139 SYN ******S*
> Oct 13 10:19:09 61.111.110.38:2769 -> xxx.yyy.224.46:139 SYN ******S*
> [...]
> Oct 13 12:53:28 61.111.110.38:4763 -> xxx.yyy.251.153:139 SYN ******S*
> Oct 13 12:53:28 61.111.110.38:4764 -> xxx.yyy.251.149:139 SYN ******S*
> Oct 13 12:53:25 61.111.110.38:4767 -> xxx.yyy.251.150:139 SYN ******S*
> Oct 13 12:53:26 61.111.110.38:4864 -> xxx.yyy.251.155:139 SYN ******S*
> Oct 13 12:53:26 61.111.110.38:4979 -> xxx.yyy.251.156:139 SYN ******S*
> Oct 13 12:53:27 61.111.110.38:4748 -> xxx.yyy.251.143:139 SYN ******S*
> Oct 13 12:53:28 61.111.110.38:4757 -> xxx.yyy.251.148:139 SYN ******S*
> Oct 13 12:53:28 61.111.110.38:4846 -> xxx.yyy.251.154:139 SYN ******S*
> 9816
>
> Oct 13 12:43:02 82.226.147.97:3021 -> xxx.yyy.245.219:139 SYN ******S*
> Oct 13 12:42:59 82.226.147.97:3046 -> xxx.yyy.177.169:139 SYN ******S*
> Oct 13 12:43:01 82.226.147.97:4993 -> xxx.yyy.248.36:139 SYN ******S*
> Oct 13 12:43:02 82.226.147.97:3022 -> xxx.yyy.179.242:139 SYN ******S*
> Oct 13 12:43:02 82.226.147.97:3047 -> xxx.yyy.111.192:139 SYN ******S*
> Oct 13 12:43:09 82.226.147.97:3133 -> xxx.yyy.241.73:139 SYN ******S*
> Oct 13 12:43:09 82.226.147.97:3157 -> xxx.yyy.239.0:139 SYN ******S*
> Oct 13 12:43:09 82.226.147.97:3158 -> xxx.yyy.173.23:139 SYN ******S*
> [...]
> Oct 13 17:57:38 82.226.147.97:4120 -> xxx.yyy.206.45:139 SYN ******S*
> Oct 13 17:57:39 82.226.147.97:4218 -> xxx.yyy.15.77:139 SYN ******S*
> Oct 13 17:59:53 82.226.147.97:4856 -> xxx.yyy.77.202:139 SYN ******S*
> Oct 13 17:59:53 82.226.147.97:4848 -> xxx.yyy.131.227:139 SYN ******S*
> Oct 13 17:59:54 82.226.147.97:4885 -> xxx.yyy.226.76:139 SYN ******S*
> Oct 13 17:59:54 82.226.147.97:4892 -> xxx.yyy.1.136:139 SYN ******S*
> Oct 13 17:59:58 82.226.147.97:4958 -> xxx.yyy.149.82:139 SYN ******S*
> Oct 13 17:59:59 82.226.147.97:4963 -> xxx.yyy.153.77:139 SYN ******S*
> 9783
>
> Oct 13 00:56:49 218.168.165.81:3407 -> xxx.yyy.72.124:5554 SYN ******S*
> Oct 13 00:56:50 218.168.165.81:3536 -> xxx.yyy.72.124:1023 SYN ******S*
> Oct 13 00:56:52 218.168.165.81:3798 -> xxx.yyy.72.124:9898 SYN ******S*
> Oct 13 00:56:49 218.168.165.81:3408 -> xxx.yyy.72.125:5554 SYN ******S*
> Oct 13 00:56:50 218.168.165.81:3537 -> xxx.yyy.72.125:1023 SYN ******S*
> Oct 13 00:56:49 218.168.165.81:3409 -> xxx.yyy.72.126:5554 SYN ******S*
> Oct 13 00:56:50 218.168.165.81:3538 -> xxx.yyy.72.126:1023 SYN ******S*
> Oct 13 00:56:52 218.168.165.81:3800 -> xxx.yyy.72.126:9898 SYN ******S*
> [...]
> Oct 13 00:59:14 218.168.165.81:4300 -> xxx.yyy.74.9:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4314 -> xxx.yyy.74.23:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4319 -> xxx.yyy.74.27:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4320 -> xxx.yyy.74.29:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4321 -> xxx.yyy.74.30:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4331 -> xxx.yyy.74.40:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4336 -> xxx.yyy.74.45:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4338 -> xxx.yyy.74.47:9898 SYN ******S*
> Oct 13 00:59:15 218.168.165.81:4351 -> xxx.yyy.74.60:9898 SYN ******S*
> 9593
>
> [...]
> 8461
>
> Oct 13 23:53:55 220.89.161.35:2111 -> xxx.yyy.235.112:5554 SYN ******S*
> Oct 13 23:53:58 220.89.161.35:3810 -> xxx.yyy.235.112:9898 SYN ******S*
> Oct 13 23:53:55 220.89.161.35:2135 -> xxx.yyy.235.114:5554 SYN ******S*
> Oct 13 23:53:56 220.89.161.35:2677 -> xxx.yyy.235.114:1023 SYN ******S*
> Oct 13 23:53:58 220.89.161.35:3941 -> xxx.yyy.235.114:9898 SYN ******S*
> Oct 13 23:53:55 220.89.161.35:2134 -> xxx.yyy.235.113:5554 SYN ******S*
> Oct 13 23:53:55 220.89.161.35:2141 -> xxx.yyy.235.116:5554 SYN ******S*
> Oct 13 23:53:56 220.89.161.35:2758 -> xxx.yyy.235.116:1023 SYN ******S*
> [...]
> Oct 13 23:54:37 220.89.161.35:1230 -> xxx.yyy.255.187:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1263 -> xxx.yyy.255.202:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1262 -> xxx.yyy.255.201:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1264 -> xxx.yyy.255.209:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1289 -> xxx.yyy.255.219:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1294 -> xxx.yyy.255.224:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1303 -> xxx.yyy.255.216:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1300 -> xxx.yyy.255.233:9898 SYN ******S*
> Oct 13 23:54:37 220.89.161.35:1301 -> xxx.yyy.255.213:9898 SYN ******S*
> 7844
>
> Oct 13 07:22:21 61.234.149.186:3020 -> xxx.yyy.1.0:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3023 -> xxx.yyy.1.2:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3037 -> xxx.yyy.1.7:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3045 -> xxx.yyy.1.11:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3047 -> xxx.yyy.1.12:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3051 -> xxx.yyy.1.14:1433 SYN ******S*
> Oct 13 07:22:18 61.234.149.186:3057 -> xxx.yyy.1.18:1433 SYN ******S*
> Oct 13 07:22:21 61.234.149.186:3074 -> xxx.yyy.1.25:1433 SYN ******S*
> [...]
> Oct 13 08:58:50 61.234.149.186:60374 -> xxx.yyy.107.240:1433 SYN  
> ******S*
> Oct 13 08:58:51 61.234.149.186:1066 -> xxx.yyy.107.247:1433 SYN  
> ******S*
> Oct 13 08:58:52 61.234.149.186:60874 -> xxx.yyy.107.215:1433 SYN  
> ******S*
> Oct 13 08:58:52 61.234.149.186:65289 -> xxx.yyy.107.219:1433 SYN  
> ******S*
> Oct 13 08:58:52 61.234.149.186:65322 -> xxx.yyy.107.222:1433 SYN  
> ******S*
> Oct 13 08:58:54 61.234.149.186:65450 -> xxx.yyy.107.238:1433 SYN  
> ******S*
> Oct 13 08:58:57 61.234.149.186:1060 -> xxx.yyy.107.245:1433 SYN  
> ******S*
> Oct 13 08:58:58 61.234.149.186:60211 -> xxx.yyy.107.249:1433 SYN  
> ******S*
> Oct 13 08:59:00 61.234.149.186:55905 -> xxx.yyy.107.254:1433 SYN  
> ******S*
> 7019
>
> Oct 13 07:22:18 211.98.106.186:20007 -> xxx.yyy.1.4:1433 SYN ******S*
> Oct 13 07:22:18 211.98.106.186:20021 -> xxx.yyy.1.13:1433 SYN ******S*
> Oct 13 07:22:21 211.98.106.186:20026 -> xxx.yyy.1.15:1433 SYN ******S*
> Oct 13 07:22:21 211.98.106.186:20038 -> xxx.yyy.1.20:1433 SYN ******S*
> Oct 13 07:22:18 211.98.106.186:20042 -> xxx.yyy.1.22:1433 SYN ******S*
> Oct 13 07:22:21 211.98.106.186:20045 -> xxx.yyy.1.24:1433 SYN ******S*
> Oct 13 07:22:21 211.98.106.186:20086 -> xxx.yyy.1.38:1433 SYN ******S*
> Oct 13 07:22:21 211.98.106.186:20097 -> xxx.yyy.1.42:1433 SYN ******S*
> [...]
> Oct 13 08:58:49 211.98.106.186:20921 -> xxx.yyy.107.250:1433 SYN  
> ******S*
> Oct 13 08:58:50 211.98.106.186:17044 -> xxx.yyy.107.239:1433 SYN  
> ******S*
> Oct 13 08:58:52 211.98.106.186:15903 -> xxx.yyy.107.216:1433 SYN  
> ******S*
> Oct 13 08:58:52 211.98.106.186:20723 -> xxx.yyy.107.225:1433 SYN  
> ******S*
> Oct 13 08:58:54 211.98.106.186:20967 -> xxx.yyy.107.255:1433 SYN  
> ******S*
> Oct 13 08:58:56 211.98.106.186:17044 -> xxx.yyy.107.239:1433 SYN  
> ******S*
> Oct 13 08:58:56 211.98.106.186:20864 -> xxx.yyy.107.243:1433 SYN  
> ******S*
> Oct 13 08:58:57 211.98.106.186:20873 -> xxx.yyy.107.246:1433 SYN  
> ******S*
> Oct 13 08:58:58 211.98.106.186:20909 -> xxx.yyy.107.248:1433 SYN  
> ******S*
> 6982
>
> [...]
> 6626
>
> Oct 13 23:57:34 222.148.19.16:2585 -> xxx.yyy.71.161:5554 SYN ******S*
> Oct 13 23:57:35 222.148.19.16:3410 -> xxx.yyy.71.161:1023 SYN ******S*
> Oct 13 23:57:37 222.148.19.16:1746 -> xxx.yyy.71.161:9898 SYN ******S*
> Oct 13 23:57:34 222.148.19.16:2603 -> xxx.yyy.71.163:5554 SYN ******S*
> Oct 13 23:57:35 222.148.19.16:3419 -> xxx.yyy.71.163:1023 SYN ******S*
> Oct 13 23:57:37 222.148.19.16:1753 -> xxx.yyy.71.163:9898 SYN ******S*
> Oct 13 23:57:34 222.148.19.16:2606 -> xxx.yyy.71.165:5554 SYN ******S*
> Oct 13 23:57:35 222.148.19.16:3426 -> xxx.yyy.71.165:1023 SYN ******S*
> [...]
> Oct 13 23:59:23 222.148.19.16:4647 -> xxx.yyy.92.16:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4609 -> xxx.yyy.92.8:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4654 -> xxx.yyy.92.18:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4641 -> xxx.yyy.92.14:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4651 -> xxx.yyy.92.17:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4703 -> xxx.yyy.92.21:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4714 -> xxx.yyy.92.25:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4713 -> xxx.yyy.92.24:9898 SYN ******S*
> Oct 13 23:59:23 222.148.19.16:4721 -> xxx.yyy.92.26:9898 SYN ******S*
> 6170
>
> --
> - Ken
> ======================================================================= 
> ====
> Ken Connelly (KC152) Systems and Operations Manager, ITS - Network  
> Services
> University of Northern Iowa                     Cedar Falls, IA   
> 50614-0121
> email: [email protected]    phone: (319) 273-5850    fax: (319)  
> 273-7373
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrusions
>

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.