[nsp-sec] DDoS towards 12.19.225.108

[Jose Nazario]

On Nov 1, 2011, at 4:47 PM, William Salusky wrote:

> Also suspicious is connectivity to 95.211.110.135:444

we have 13 samples that match that IP:port all tagged "buzy". we have not seen it ddos and have not seen obvious signs of ddos in those samples yet.

_____________________________
jose nazario, ph.d. jose at arbor.net
sr. manager of security research, arbor networks
blog:    http://asert.arbor.net/
twitter: @arbornetworks