I noticed unusual and apparently coordinated ping activity from about
a dozen of hosts against my box, when I inspected my logs[1] this
morning.
I'm not especially worried about this regarding my own box (doesn't
seem to be very efficient...) , but could
this be a hint, that some of those boxes are compromised and will be
used in a real (large-scale) attack?
Thanks in advance,
Mar 3 23:58:46 seitung icmplogd: ping from cts21612068130.cts.com [216.120.68.130]
Mar 3 23:58:46 seitung icmplogd: ping from ppp-64-160-241-3.cqos.com [64.160.241.3]
Mar 3 23:58:46 seitung icmplogd: ping from thor.bbox.net [208.161.96.187]
Mar 3 23:58:46 seitung icmplogd: ping from [134.68.82.150]
Mar 3 23:58:46 seitung icmplogd: ping from adsl-216-62-158-3.dsl.hstntx.swbell.net
[216.62.158.3]
Mar 3 23:58:46 seitung icmplogd: ping from ppp-64-160-241-3.cqos.com [64.160.241.3]
Mar 3 23:58:46 seitung icmplogd: ping from cts21612068130.cts.com [216.120.68.130]
Mar 3 23:58:46 seitung icmplogd: ping from sidflask.campus.luth.se [130.240.201.200]
Mar 3 23:58:46 seitung icmplogd: ping from 24.68.115.181.on.wave.home.com
[24.68.115.181]
Mar 3 23:58:46 seitung icmplogd: ping from sidflask.campus.luth.se [130.240.201.200]
Mar 3 23:58:46 seitung icmplogd: ping from gandalf.globig.com [209.12.117.158]
Mar 3 23:58:47 seitung icmplogd: ping from covert.operations.net [64.163.64.198]
Mar 3 23:58:47 seitung icmplogd: ping from [38.194.103.224]
Mar 3 23:58:47 seitung icmplogd: ping from covert.operations.net [64.163.64.198]
Mar 3 23:58:47 seitung icmplogd: ping from gandalf.globig.com [209.12.117.158]
Mar 3 23:58:47 seitung icmplogd: ping from 24.68.115.181.on.wave.home.com
[24.68.115.181]
Mar 3 23:58:47 seitung icmplogd: ping from mlibw245-188-s.dhcp.CSUChico.EDU
[132.241.245.188]
Mar 3 23:58:47 seitung icmplogd: ping from sidflask.campus.luth.se [130.240.201.200]
Mar 3 23:58:47 seitung icmplogd: ping from [38.194.103.224]
Mar 3 23:58:47 seitung icmplogd: ping from covert.operations.net [64.163.64.198]
Mar 3 23:58:47 seitung icmplogd: ping from gandalf.globig.com [209.12.117.158]
Mar 3 23:58:47 seitung icmplogd: ping from [207.189.150.228]
Mar 3 23:58:48 seitung icmplogd: ping from agga373fy58qi.ab.hsia.telus.net
[142.59.198.153]
Mar 3 23:58:48 seitung icmplogd: ping from mlibw245-188-s.dhcp.CSUChico.EDU
[132.241.245.188]
Mar 3 23:58:48 seitung icmplogd: ping from ip-12-35-192-61.hqglobal.net [12.35.192.61]
Mar 3 23:58:48 seitung icmplogd: ping from [38.194.103.224]
Mar 3 23:58:48 seitung icmplogd: ping from [207.189.150.228]
Mar 3 23:58:48 seitung icmplogd: ping from mlibw245-188-s.dhcp.CSUChico.EDU
[132.241.245.188]
Mar 3 23:58:48 seitung icmplogd: ping from ip-12-35-192-61.hqglobal.net [12.35.192.61]
Mar 3 23:58:48 seitung icmplogd: ping from agga373fy58qi.ab.hsia.telus.net
[142.59.198.153]
Mar 3 23:58:48 seitung icmplogd: ping from [207.189.150.228]
Mar 3 23:58:48 seitung icmplogd: ping from ip-12-35-192-61.hqglobal.net [12.35.192.61]
Mar 3 23:58:48 seitung icmplogd: ping from agga373fy58qi.ab.hsia.telus.net
[142.59.198.153]
Mar 3 23:58:48 seitung icmplogd: ping from user-v3qs53k.dialup.mindspring.com
[199.174.20.116]
Mar 3 23:58:48 seitung icmplogd: ping from [209.37.71.1]
Mar 3 23:58:48 seitung icmplogd: ping from user-v3qs53k.dialup.mindspring.com
[199.174.20.116]
Mar 3 23:58:49 seitung icmplogd: ping from [205.158.114.146]
Mar 3 23:58:49 seitung icmplogd: ping from ubr-33.152.185.apopkavine.cfl.rr.com
[65.33.152.185]
Mar 3 23:58:49 seitung icmplogd: ping from [205.158.114.146]
Mar 3 23:58:49 seitung icmplogd: ping from ubr-33.152.185.apopkavine.cfl.rr.com
[65.33.152.185]
Mar 3 23:58:49 seitung icmplogd: ping from [209.37.71.1]
Mar 3 23:58:49 seitung icmplogd: ping from ubr-33.152.185.apopkavine.cfl.rr.com
[65.33.152.185]
Mar 3 23:58:49 seitung icmplogd: ping from [205.158.114.146]
Mar 3 23:58:49 seitung icmplogd: ping from [209.37.71.1]
Mar 3 23:58:49 seitung icmplogd: ping from gurney.cs.umn.edu [128.101.32.141]
Mar 3 23:58:49 seitung icmplogd: ping from gurney.cs.umn.edu [128.101.32.141]
log_excerpt.txt.sig
PGP signature
MH
--
(Dr.) Michael Hummel
mailto: [EMAIL PROTECTED] || [EMAIL PROTECTED]
Footnotes:
[1] attached
--
fprint = F24D EAC6 E3D7 372C 9122 D510 EB24 01CA 0B56 B518
id: 1024D/0B56B518 key: http://www.seitung.net/key
