Re: slowish ssh scan from 149.69.85.65

From: Glenn Forbes Fleming Larratt (glratt@io.com)
Date: 12/05/01 

Date: Wed, 5 Dec 2001 11:52:35 -0600 (CST)
From: Glenn Forbes Fleming Larratt <glratt@io.com>
To: <incidents@securityfocus.com>

On Wed, 5 Dec 2001, Russell Fulton wrote:

> Greetings All,
>
> starting on 4th Dec 2001 at 19:47 (UTC) we saw an unusual scan from
> 149.69.85.65 (owned by St. John Fisher College (NET-PSINET-B-69)) who
> have been notified -- no response yet.
>
> times are UTC:
>
> Here are argus logs from the start of the scan:
>
> 04 Dec 01 19:47:36 tcp 149.69.85.65.20 -> 130.216.246.76.22 S_

Us, too (i.e. noted and blocked) (timestamps in CST [6hr west of UTC]):

[4 Dec ...]
18:49:26.223817 149.69.85.65.20 > MY.NET.10.38.22: S 2168502234:2168502234(0) win 16383 (DF)
18:49:26.224625 149.69.85.65.20 > MY.NET.46.172.22: S 1105269703:1105269703(0) win 16383 (DF)
18:49:26.227256 149.69.85.65.20 > MY.NET.83.50.22: S 1657904554:1657904554(0) win 16383 (DF)
19:37:53.536652 149.69.85.65.20 > MY.NET.186.198.22: S 3121786201:3121786201(0) win 16383 (DF)
19:37:53.536980 149.69.85.65.20 > MY.NET.223.76.22: S 2535195653:2535195653(0) win 16383 (DF)
20:23:45.174780 149.69.85.65.20 > MY.NET.253.212.22: S 2148637354:2148637354(0) win 16383 (DF)
22:11:58.666148 149.69.85.65.20 > MY.NET.132.70.22: S 2788760079:2788760079(0) win 16383 (DF)
        :
        :
        :
[5 Dec ...]
04:09:35.725747 149.69.85.65.20 > MY.NET.24.234.22: S 2517150545:2517150545(0) win 16383 (DF)
04:09:35.727293 149.69.85.65.20 > MY.NET.61.112.22: S 1628242169:1628242169(0) win 16383 (DF)
04:09:35.727798 149.69.85.65.20 > MY.NET.97.246.22: S 2442363253:2442363253(0) win 16383 (DF)
04:09:35.728948 149.69.85.65.20 > MY.NET.134.124.22: S 1516061231:1516061231(0) win 16383 (DF)
04:09:35.729401 149.69.85.65.20 > MY.NET.171.2.22: S 2274091846:2274091846(0) win 16383 (DF)
04:09:35.729733 149.69.85.65.20 > MY.NET.207.136.22: S 1263654121:1263654121(0) win 16383 (DF)
05:01:53.515893 149.69.85.65.20 > MY.NET.91.248.22: S 1300803353:1300803353(0) win 16383 (DF)
05:12:50.074005 149.69.85.65.20 > MY.NET.26.142.22: S 1540461245:1540461245(0) win 16383 (DF)
05:12:50.074471 149.69.85.65.20 > MY.NET.63.20.22: S 2310691867:2310691867(0) win 16383 (DF)
05:12:50.074602 149.69.85.65.20 > MY.NET.63.20.22: S 2310691867:2310691867(0) win 16383 (DF)
05:12:50.075101 149.69.85.65.20 > MY.NET.99.154.22: S 1318554152:1318554152(0) win 16383 (DF)
05:25:35.554361 149.69.85.65.20 > MY.NET.34.48.22: S 2277649205:2277649205(0) win 16383 (DF)
05:25:35.554696 149.69.85.65.20 > MY.NET.70.182.22: S 1268990159:1268990159(0) win 16383 (DF)
05:25:35.555322 149.69.85.65.20 > MY.NET.107.60.22: S 1903485238:1903485238(0) win 16383 (DF)
05:25:35.555674 149.69.85.65.20 > MY.NET.143.194.22: S 2855227857:2855227857(0) win 16383 (DF)
05:25:35.556002 149.69.85.65.20 > MY.NET.180.72.22: S 2135358137:2135358137(0) win 16383 (DF) 

-- 
Glenn Forbes Fleming Larratt         The Lab Ratt (not briggs :-)
glratt@io.com                        http://www.io.com/~glratt
There are imaginary bugs to chase in heaven.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Re: daylight savings time / quark express
    ... Thanks for your response and appreciate your time and effort on this issue. ... The files on a PC/MAC file share, when altered, both show the same UTC ... So, regardless of what OS the file is altered on, the UTC will change. ... This is why Quark has the problem with Daylight Savings Time. ...
    (microsoft.public.win2000.general)
  • Re: Transformer Frequency Response Problem
    ... I am attempting to plot the frequency response curves of several UTC ... I tried several transformers ... it's an actual dip and not a shelf? ...
    (rec.audio.pro)
  • Re: Eclipse - Do they have Time Servers customers can sync their PCs with?
    ... >Thanks for the impressively quick response (though some of you seemed to ... not relevant, all timeservers show UTC. ... >I've a feeling that the next question might be how to get the NTP through ...
    (uk.telecom.broadband)
  • Re: [patch 00/32] -stable review
    ... There are 32 patches in this series, all will be posted as a response ... to use the missing file: ... Responses should be made by Mon Dec 11 00:00 UTC Anything received after ...
    (Linux-Kernel)
Loading