[nsp-sec] Possible AT&T DoS

[Rob Thomas]

Hey, Tino.

> We are seeing quite a bit of TCP ACK traffic all of a sudden to 63.240.117.170.

We see 63.240.117.170 attempting to connect to a known C&C on
196.205.243.52.  The C&C port we see is on TCP 1993, however.  The most
recent connection attempt is 2009-01-15 19:14:48 UTC.

Dunno if that's related, but I thought I'd mention it.

Thanks,
Rob.
-- 
Rob Thomas
Team Cymru
http://www.team-cymru.org/
cmn_err(CEO_PANIC, "Out of coffee!");