[nsp-sec] ddos against 83.171.11.27-28

[Marius Urkis]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

We saw a DDoS attacks against 83.171.11.27 and 83.171.11.57, a port
UDP/21 was used. Attack started at 19:57 GMT+3, September 21.  Likely
compromised web servers were used for the attack. Please find source IPs
in the attachment.

Marius Urkis wrote:
> ----------- nsp-security Confidential --------
> 
> 
> 
> ------------------------------------------------------------------------
> 
> Hello
> 
> We experienced several UDP flood attacks against two IP addresses
> 83.171.11.27 and 83.171.11.28. Packets used were UDP/22 and UDP/8684.
> 
> Please find the list of source IP addresses attached. Time specifies the
> first packet seen (GMT+3).
> 
> 
> Regards

- ------------------------------------------------------------------------



_______________________________________________
nsp-security mailing list
nsp-security at puck.nether.net
https://puck.nether.net/mailman/listinfo/nsp-security

Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
community. Confidentiality is essential for effective Internet security
counter-measures.
_______________________________________________


- --
Marius

=============================
 Marius Urkis
 LITNET CERT
 http://cert.litnet.lt
 Tel: +370 37 300645
 GSM: +370 687 79059
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkq4fU8ACgkQHS98nbdNAJx4HQCeIyQgF5zRTsiXCypuW2WpyY3w
U0EAn3/jK5pY0n/b9eNm/xH4JRSVgjyI
=SVZW
-----END PGP SIGNATURE-----
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 1253601834.whois.txt
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20090922/ff65ee7a/attachment-0001.txt>