Port scans

Andy Civil <[email protected]>
Newsgroups gmane.user-groups.linux.ottawa.general
Message-ID <[email protected]> 
I've received a bunch of port scans from a machine that appears to belong to
someone on this list, because I recognise the name. I've emailed him directly,
meanwhile, does this look like virus activity, or maliciousness or plain old
schoolboy hacking, or what?


[24/Jul/2009 21:46:08]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:08]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN SYN FIN', url = 'http://www.whitehats.com/info/IDS198', direc =
'in', class = 'attempted-recon', priority = medium
[24/Jul/2009 21:46:09]  "Ids" action = 'detected', raddr = '<ip addr censored>',
msg = 'PortScan', url = '', direc = 'in', class = 'network-scan', priority =
portscan
[24/Jul/2009 21:46:18]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:18]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:18]  "Ids" action = 'permitted', raddr = '<ip addr
censored>', msg = 'BAD-TRAFFIC tcp port 0 traffic', url = '', direc = 'in',
class = 'misc-activity', priority = low
[24/Jul/2009 21:46:20] Last message repeated 4 times
[24/Jul/2009 21:46:20]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:20]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:20]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap XMAS', url = 'http://www.whitehats.com/info/IDS30', direc =
'in', class = 'attempted-recon', priority = medium
[24/Jul/2009 21:46:20]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:20]  "Ids" action = 'permitted', raddr = '<ip addr
censored>', msg = 'BAD-TRAFFIC tcp port 0 traffic', url = '', direc = 'in',
class = 'misc-activity', priority = low
[24/Jul/2009 21:46:21]  "Ids" action = 'permitted', raddr = '<ip addr
censored>', msg = 'BAD-TRAFFIC tcp port 0 traffic', url = '', direc = 'in',
class = 'misc-activity', priority = low
[24/Jul/2009 21:46:21]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:21]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN XMAS', url = 'http://www.whitehats.com/info/IDS144', direc = 'in',
class = 'attempted-recon', priority = medium
[24/Jul/2009 21:46:22]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:22] Last message repeated 3 times
[24/Jul/2009 21:46:22]  "Ids" action = 'permitted', raddr = '<ip addr
censored>', msg = 'BAD-TRAFFIC tcp port 0 traffic', url = '', direc = 'in',
class = 'misc-activity', priority = low
[24/Jul/2009 21:46:22]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:22]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN XMAS', url = 'http://www.whitehats.com/info/IDS144', direc = 'in',
class = 'attempted-recon', priority = medium
[24/Jul/2009 21:46:22]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap XMAS', url = 'http://www.whitehats.com/info/IDS30', direc =
'in', class = 'attempted-recon', priority = medium
[24/Jul/2009 21:46:22]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:22]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN nmap fingerprint attempt', url =
'http://www.whitehats.com/info/IDS05', direc = 'in', class = 'attempted-recon',
priority = medium
[24/Jul/2009 21:46:22]  "Ids" action = 'permitted', raddr = '<ip addr
censored>', msg = 'BAD-TRAFFIC tcp port 0 traffic', url = '', direc = 'in',
class = 'misc-activity', priority = low
[24/Jul/2009 21:46:26] Last message repeated 9 times
[24/Jul/2009 21:46:26]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN XMAS', url = 'http://www.whitehats.com/info/IDS144', direc = 'in',
class = 'attempted-recon', priority = medium
[24/Jul/2009 21:46:26]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN XMAS', url = 'http://www.whitehats.com/info/IDS144', direc = 'in',
class = 'attempted-recon', priority = medium
[24/Jul/2009 21:46:26]  "Ids" action = 'denied', raddr = '<ip addr censored>',
msg = 'SCAN SYN FIN', url = 'http://www.whitehats.com/info/IDS198', direc =
'in', class = 'attempted-recon', priority = medium

-- 
OCLUG general discussion list
[email protected]
http://oclug.on.ca/mailman/listinfo/oclug
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.