[nsp-sec] Attack on www.gsn.com 07/23/2011?
Yiming Gong
yiming.gong at xo.com
Wed Jul 27 15:55:49 EDT 2011
I see two hosts 67.207.144.116 and 67.207.145.123 having quite some
traffic traversing our network during that time frame. And they are
already on the list you sent out.
On the other hand, i do noticed both hosts were talking to
81.169.181.251 on port 443 as you can see below, not sure what that
could be,
2011-07-23 11:50:41.653 0.000 TCP 67.207.145.123:51984 ->
81.169.181.251:443 .A.... 1000 52000 1 220 181
2011-07-23 11:58:25.495 0.000 TCP 67.207.144.116:38399 ->
81.169.181.251:443 .A.... 1000 52000 1 220 181
2011-07-23 11:59:36.527 0.000 TCP 67.207.145.123:45844 ->
81.169.181.251:443 .A...F 1000 52000 1 220 181
2011-07-23 12:04:32.623 0.000 TCP 67.207.145.123:35119 ->
81.169.181.251:443 ....S. 1000 60000 1 220 181
2011-07-23 12:05:28.078 0.000 TCP 67.207.145.123:57369 ->
81.169.181.251:443 ....S. 1000 60000 1 220 181
2011-07-23 12:02:56.877 0.000 TCP 67.207.144.116:47457 ->
81.169.181.251:443 .AP... 5000 455000 1 811 926
the attacking traffic
2011-07-23 11:50:28.779 33.106 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 7.1 M 555.8 M 1 220 181
2011-07-23 11:50:28.842 33.042 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 3.9 M 307.5 M 1 220 181
2011-07-23 11:51:01.998 59.889 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 12.1 M 942.5 M 1 220 181
2011-07-23 11:51:01.998 59.889 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 6.2 M 486.8 M 1 220 181
2011-07-23 11:52:02.939 59.948 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 12.8 M 997.8 M 1 220 181
2011-07-23 11:52:02.939 59.948 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 9.2 M 715.6 M 1 220 181
2011-07-23 11:53:02.942 59.901 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 11.6 M 905.4 M 1 220 181
2011-07-23 11:53:02.941 59.901 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 5.8 M 449.9 M 1 220 181
2011-07-23 11:54:02.939 59.955 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 12.7 M 989.6 M 1 220 181
2011-07-23 11:54:02.939 59.954 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 6.3 M 488.2 M 1 220 181
2011-07-23 11:55:02.939 59.925 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 12.0 M 933.3 M 1 220 181
2011-07-23 11:55:02.938 59.925 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 6.7 M 525.2 M 1 220 181
2011-07-23 11:56:02.936 59.945 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 11.4 M 887.6 M 1 220 181
2011-07-23 11:56:02.936 59.946 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 7.9 M 616.0 M 1 220 181
2011-07-23 11:57:02.931 59.963 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 10.9 M 850.3 M 1 220 181
2011-07-23 11:57:02.920 59.963 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 10.4 M 813.5 M 1 220 181
2011-07-23 11:58:02.940 59.925 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 11.9 M 925.1 M 1 220 181
2011-07-23 11:58:02.940 59.871 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 7.2 M 557.8 M 1 220 181
2011-07-23 11:59:02.948 59.940 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 11.2 M 876.6 M 1 220 181
2011-07-23 11:59:02.948 59.749 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 5.7 M 446.4 M 1 220 181
2011-07-23 12:00:02.921 54.373 UDP 67.207.144.116:44543 ->
66.150.203.80:113 ...... 9.9 M 775.4 M 1 220 181
2011-07-23 12:00:02.991 54.373 UDP 67.207.145.123:34468 ->
66.150.203.80:113 ...... 4.3 M 332.7 M 1 220 181
Regards
Yiming
On 07/27/2011 01:52 PM, Chris Jackman wrote:
> ----------- nsp-security Confidential --------
>
>
> Hello all.
>
> A friend at the GameShow Network asked me to ask
> if anyone saw anything against www.gsn.com
> on Saturday, July 23rd, 2011, between 12:50pm and 13:00 pm Eastern Time.
>
> I'm told the target was www.gsn.com at 66.150.203.80 and packets were udp
> port 113.
>
> I was sent this list of ips:
>
>
> 194.204.42.237 : dsl42-237.uninet.ee.
> 85.25.135.160 : delta552.server4you.de.
> 67.207.144.116 : 67-207-144-116.slicehost.net.
> 174.129.2.77 : ec2-174-129-2-77.compute-1.amazonaws.com.
> 194.164.225.146 : alexander.paston.co.uk.
> 184.73.252.136 : viral-manager.com.
> 203.201.149.67 :
> 85.25.147.195 : hotel564.server4you.de.
> 67.207.145.123 : 67-207-145-123.slicehost.net.
> 184.73.154.140 : ec2-184-73-154-140.compute-1.amazonaws.com.
> 195.54.198.31 : mail.zdr.ru.
> 77.111.153.210 : ip-153-210-userpool.zeg.zelkanet.hu.
> 188.94.232.11 : mail2.kralovice.cz.
> 74.207.251.120 : li93-120.members.linode.com.
>
> I'm told they blocked 194.204.42.237 first and then the others
> faded away. They noticed some of those hosts answer port 22
> as Debian or Ubuntu.
>
> Thanks.
> -cj
>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________
>
>
More information about the nsp-security
mailing list