[nsp-sec] RDP scanners by ASN
Russell Fulton
r.fulton at auckland.ac.nz
Sun Oct 23 03:51:28 EDT 2011
*************** NOTE: TZ is UTC adjusted from '+13:00' ***************
ASN | IP Start Time Finish Time count | Snort Sig
577 | 65.95.57.117 2011-10-22:05:04:33 2011-10-22:05:34:48 6 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
577 | 142.217.244.189 2011-10-22:17:21:32 2011-10-22:17:45:49 5 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
1221 | 165.228.137.141 2011-10-22:15:01:36 2011-10-22:15:13:47 3 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
1241 | 46.12.9.148 2011-10-22:06:43:27 2011-10-22:07:26:23 8 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
1267 | 151.64.190.4 2011-10-23:00:36:22 2011-10-23:01:06:35 6 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
2042 | 202.186.59.50 2011-10-22:15:08:05 2011-10-22:15:38:36 6 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
3269 | 79.4.182.121 2011-10-22:02:35:44 2011-10-22:03:20:21 8 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
3269 | 79.4.248.102 2011-10-22:21:13:47 2011-10-22:21:44:12 6 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
3269 | 82.105.85.253 2011-10-22:22:11:09 2011-10-22:22:59:25 9 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
3269 | 88.46.110.201 2011-10-22:19:29:10 2011-10-22:20:05:35 7 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
3320 | 91.32.7.188 2011-10-22:03:57:08 2011-10-22:04:46:12 9 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
3320 | 217.80.55.162 2011-10-22:08:25:01 2011-10-22:09:01:30 7 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
3320 | 217.237.29.179 2011-10-22:17:09:38 2011-10-22:17:58:04 9 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
3352 | 80.24.137.131 2011-10-22:19:00:25 2011-10-22:19:55:25 10 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
3462 | 114.33.115.80 2011-10-23:01:34:09 2011-10-23:02:16:30 8 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 14.111.62.17 2011-10-22:22:44:02 2011-10-22:23:26:31 8 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 14.145.104.53 2011-10-23:02:52:45 2011-10-23:03:29:19 7 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 58.211.179.178 2011-10-23:03:53:31 2011-10-23:04:42:07 9 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 60.164.142.55 2011-10-23:04:10:32 2011-10-23:04:51:23 3 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 113.105.64.153 2011-10-22:23:11:03 2011-10-22:23:35:22 5 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 113.106.58.18 2011-10-23:04:45:05 2011-10-23:05:40:42 10 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 117.27.187.246 2011-10-22:04:46:41 2011-10-22:04:52:47 2 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 119.86.106.58 2011-10-22:16:43:21 2011-10-22:17:32:16 9 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 125.74.154.111 2011-10-23:05:00:49 2011-10-23:05:13:03 3 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 180.111.54.61 2011-10-22:21:18:10 2011-10-22:21:48:29 6 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 219.134.28.125 2011-10-22:16:30:33 2011-10-23:05:53:20 2 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 219.136.91.63 2011-10-23:04:05:55 2011-10-23:04:48:36 8 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 222.76.85.103 2011-10-22:06:15:35 2011-10-22:07:04:19 9 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4134 | 223.144.24.128 2011-10-22:12:55:38 2011-10-22:12:55:38 1 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4230 | 189.3.92.206 2011-10-22:17:48:34 2011-10-22:17:54:34 2 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4766 | 112.163.49.187 2011-10-22:11:10:12 2011-10-22:11:22:16 3 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4775 | 203.177.133.195 2011-10-22:02:40:51 2011-10-22:03:17:34 7 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4804 | 110.33.99.63 2011-10-23:01:22:18 2011-10-23:01:52:41 6 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4808 | 58.30.79.1 2011-10-22:05:45:05 2011-10-23:05:02:58 11 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4808 | 117.117.117.35 2011-10-22:23:15:18 2011-10-22:23:58:24 8 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4812 | 116.228.43.6 2011-10-22:05:48:17 2011-10-22:06:31:02 8 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4837 | 113.237.34.111 2011-10-23:01:04:52 2011-10-23:01:53:33 9 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4837 | 116.255.136.166 2011-10-22:04:32:44 2011-10-22:04:32:44 1 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4837 | 119.188.7.149 2011-10-23:01:26:17 2011-10-23:04:05:58 2 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4837 | 124.164.250.226 2011-10-22:17:15:28 2011-10-22:18:04:13 9 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4837 | 221.7.135.250 2011-10-22:16:19:53 2011-10-22:16:19:53 1 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4837 | 222.140.105.50 2011-10-22:05:40:31 2011-10-22:06:35:30 10 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
4853 | 202.4.95.148 2011-10-22:16:16:22 2011-10-22:16:34:40 4 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
5384 | 86.96.195.217 2011-10-22:10:27:09 2011-10-22:10:27:09 1 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
5522 | 62.212.209.67 2011-10-22:20:31:07 2011-10-22:22:47:49 18 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
6389 | 74.164.84.52 2011-10-23:06:45:11 2011-10-23:06:45:11 1 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
6799 | 79.129.97.169 2011-10-23:05:58:32 2011-10-23:06:47:49 9 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
7015 | 71.234.99.14 2011-10-23:00:50:22 2011-10-23:01:08:29 4 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
7132 | 67.127.103.53 2011-10-22:18:23:41 2011-10-22:19:00:07 7 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
7132 | 71.143.117.14 2011-10-22:08:03:01 2011-10-22:08:27:41 5 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
7132 | 75.37.59.0 2011-10-22:19:51:45 2011-10-22:20:34:13 8 | ET SCAN Behavioral Unusually fast Terminal Server Traffic, Potential Scan or Infection
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20111023/c28faaeb/attachment-0001.sig>
More information about the nsp-security
mailing list