🔒 Locked

Being attacked?

Started by 1337Haxor Mar 22, 2004 at 3:26 PM 15 replies 3k views

Original Post

Mar 22, 2004 at 3:26 PM

quote:
March 22, 2004 12:44:15 PM Unrecognized access from 24.71.245.79:3242 to TCP port 445 March 22, 2004 12:45:05 PM Unrecognized access from 61.173.0.147:4998 to UDP port 137 March 22, 2004 12:47:23 PM Unrecognized access from 4.10.123.134:1027 to UDP port 137 March 22, 2004 12:48:12 PM Unrecognized access from 24.71.194.19:1831 to TCP port 135 March 22, 2004 12:48:40 PM Unrecognized access from 200.244.56.34:11786 to TCP port 445 March 22, 2004 12:48:43 PM Unrecognized access from 200.244.56.34:11786 to TCP port 445 March 22, 2004 12:51:47 PM Unrecognized access from 67.100.207.62:25564 to TCP port 445 March 22, 2004 12:51:51 PM Unrecognized access from 67.100.207.62:25564 to TCP port 445 March 22, 2004 12:51:57 PM Unrecognized access from 67.100.207.62:25564 to TCP port 445 March 22, 2004 12:52:22 PM Unrecognized access from 213.234.89.76:1029 to UDP port 137 March 22, 2004 12:52:40 PM Unrecognized access from 3.201.183.178:23701 to UDP port 1026 March 22, 2004 12:52:41 PM Unrecognized access from 4.44.109.92:3548 to UDP port 1027 March 22, 2004 1:01:39 PM Unrecognized access from 61.17.107.11:777 to UDP port 1026 March 22, 2004 1:01:39 PM Unrecognized access from 24.71.0.103:2769 to TCP port 135 March 22, 2004 1:02:42 PM Unrecognized access from 67.5.146.27:4650 to TCP port 445 March 22, 2004 1:02:45 PM Unrecognized access from 67.5.146.27:4650 to TCP port 445 March 22, 2004 1:02:51 PM Unrecognized access from 67.5.146.27:4650 to TCP port 445 March 22, 2004 1:03:22 PM Unrecognized access from 24.71.86.244:2946 to TCP port 445 March 22, 2004 1:03:24 PM Unrecognized access from 24.71.86.244:2946 to TCP port 445 March 22, 2004 1:03:51 PM Unrecognized access from 24.67.253.203:80 to TCP port 35956 March 22, 2004 1:07:00 PM Unrecognized access from 24.71.63.198:3883 to TCP port 135 March 22, 2004 1:07:00 PM Unrecognized access from 24.71.63.198:3885 to TCP port 445 March 22, 2004 1:07:03 PM Unrecognized access from 24.71.63.198:3883 to TCP port 135 March 22, 2004 1:07:03 PM Unrecognized access from 24.71.63.198:3886 to TCP port 3127 March 22, 2004 1:07:03 PM Unrecognized access from 24.71.63.198:3884 to TCP port 1025 March 22, 2004 1:07:09 PM Unrecognized access from 24.71.63.198:3881 to TCP port 2745 March 22, 2004 1:07:17 PM Unrecognized access from 24.72.93.184:4377 to TCP port 135 March 22, 2004 1:07:20 PM Unrecognized access from 24.72.93.184:4377 to TCP port 135 March 22, 2004 1:07:26 PM Unrecognized access from 24.72.93.184:4377 to TCP port 135 March 22, 2004 1:08:19 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7261 March 22, 2004 1:08:19 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7261 March 22, 2004 1:08:19 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7261 March 22, 2004 1:08:19 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7267 March 22, 2004 1:08:19 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7267 March 22, 2004 1:08:19 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7267 March 22, 2004 1:08:19 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7271 March 22, 2004 1:08:19 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7271 March 22, 2004 1:08:19 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7271 March 22, 2004 1:08:21 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7273 March 22, 2004 1:08:21 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7239 March 22, 2004 1:08:21 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7261 March 22, 2004 1:08:26 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7273 March 22, 2004 1:08:26 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7239 March 22, 2004 1:08:26 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7275 March 22, 2004 1:08:27 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7267 March 22, 2004 1:08:34 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7273 March 22, 2004 1:08:34 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7239 March 22, 2004 1:08:37 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7275 March 22, 2004 1:08:37 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7249 March 22, 2004 1:08:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7261 March 22, 2004 1:08:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7271 March 22, 2004 1:08:56 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7275 March 22, 2004 1:08:56 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7249 March 22, 2004 1:08:58 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7261 March 22, 2004 1:08:59 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7271 March 22, 2004 1:09:00 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7267 March 22, 2004 1:09:25 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7273 March 22, 2004 1:09:25 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7239 March 22, 2004 1:09:40 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7261 March 22, 2004 1:09:43 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7267 March 22, 2004 1:10:22 PM Unrecognized access from 24.70.126.134:4332 to TCP port 135 March 22, 2004 1:10:25 PM Unrecognized access from 24.70.126.134:4332 to TCP port 135 March 22, 2004 1:10:31 PM Unrecognized access from 24.70.126.134:4332 to TCP port 135 March 22, 2004 1:10:31 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7273 March 22, 2004 1:10:46 PM Unrecognized access from 24.70.121.147:1245 to TCP port 445 March 22, 2004 1:10:49 PM Unrecognized access from 24.70.121.147:1245 to TCP port 445 March 22, 2004 1:10:51 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7275 March 22, 2004 1:10:51 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7249 March 22, 2004 1:10:55 PM Unrecognized access from 24.70.1.117:3873 to TCP port 135 March 22, 2004 1:10:56 PM Unrecognized access from 24.70.121.147:1245 to TCP port 445 March 22, 2004 1:10:58 PM Unrecognized access from 24.70.1.117:3873 to TCP port 135 March 22, 2004 1:11:03 PM Unrecognized access from 24.67.253.203:8080 to TCP port 7271 March 22, 2004 1:11:04 PM Unrecognized access from 24.70.1.117:3873 to TCP port 135 March 22, 2004 1:12:01 PM Unrecognized access from 24.72.25.223:3028 to TCP port 135 March 22, 2004 1:12:04 PM Unrecognized access from 24.72.25.223:3028 to TCP port 135 March 22, 2004 1:12:10 PM Unrecognized access from 24.72.25.223:3028 to TCP port 135 March 22, 2004 1:12:35 PM Unrecognized access from 24.71.206.39:3907 to TCP port 135 March 22, 2004 1:12:38 PM Unrecognized access from 24.71.206.39:3907 to TCP port 135 March 22, 2004 1:12:44 PM Unrecognized access from 24.71.206.39:3907 to TCP port 135 March 22, 2004 1:17:06 PM Unrecognized access from 24.67.253.204:8080 to TCP port 5095 March 22, 2004 1:17:07 PM Unrecognized access from 24.67.253.204:8080 to TCP port 5095 March 22, 2004 1:17:11 PM Unrecognized access from 24.67.253.204:8080 to TCP port 5095 March 22, 2004 1:17:19 PM Unrecognized access from 24.67.253.204:8080 to TCP port 5095 March 22, 2004 1:17:26 PM Unrecognized access from 24.67.253.203:8080 to TCP port 20943 March 22, 2004 1:17:28 PM Unrecognized access from 24.67.253.203:8080 to TCP port 20943 March 22, 2004 1:17:32 PM Unrecognized access from 24.67.253.203:8080 to TCP port 20943 March 22, 2004 1:17:37 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21074 March 22, 2004 1:17:37 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21074 March 22, 2004 1:17:37 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21074 March 22, 2004 1:17:37 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21074 March 22, 2004 1:17:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21080 March 22, 2004 1:17:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21080 March 22, 2004 1:17:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21080 March 22, 2004 1:17:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21080 March 22, 2004 1:17:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083 March 22, 2004 1:17:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083 March 22, 2004 1:17:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083 March 22, 2004 1:17:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083 March 22, 2004 1:17:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083 March 22, 2004 1:17:39 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21080 March 22, 2004 1:17:39 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21064 March 22, 2004 1:17:39 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21078 March 22, 2004 1:17:40 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083 March 22, 2004 1:17:40 PM Unrecognized access from 24.67.253.203:8080 to TCP port 20943 March 22, 2004 1:17:42 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21080 March 22, 2004 1:17:43 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083 March 22, 2004 1:17:43 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21064 March 22, 2004 1:17:46 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21077 March 22, 2004 1:17:47 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21075 March 22, 2004 1:17:47 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21074 March 22, 2004 1:17:48 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21080 March 22, 2004 1:17:48 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083 March 22, 2004 1:17:56 PM Unrecognized access from 24.67.253.203:8080 to TCP port 20943 March 22, 2004 1:17:57 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21077 March 22, 2004 1:17:57 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21075 March 22, 2004 1:17:57 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21082 March 22, 2004 1:17:59 PM Unrecognized access from 24.72.57.50:2799 to TCP port 135 March 22, 2004 1:17:59 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083 March 22, 2004 1:18:02 PM Unrecognized access from 24.72.57.50:2799 to TCP port 135 March 22, 2004 1:18:03 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21078 March 22, 2004 1:18:06 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21064 March 22, 2004 1:18:07 PM Unrecognized access from 24.72.57.50:2799 to TCP port 135 March 22, 2004 1:18:18 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21077 March 22, 2004 1:18:18 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21075 March 22, 2004 1:18:18 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21082 March 22, 2004 1:18:21 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21080 March 22, 2004 1:18:22 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083 March 22, 2004 1:18:25 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21074 March 22, 2004 1:18:28 PM Unrecognized access from 24.67.253.203:8080 to TCP port 20943 March 22, 2004 1:18:29 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22355 March 22, 2004 1:18:29 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22355 March 22, 2004 1:18:29 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22355 March 22, 2004 1:18:29 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22355 March 22, 2004 1:18:29 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22356 March 22, 2004 1:18:29 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22356 March 22, 2004 1:18:29 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22356 March 22, 2004 1:18:29 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22356 March 22, 2004 1:18:30 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22355 March 22, 2004 1:18:31 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22633 March 22, 2004 1:18:33 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22355 March 22, 2004 1:18:39 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22355 March 22, 2004 1:18:43 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22711 March 22, 2004 1:18:44 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22711 March 22, 2004 1:18:48 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22711 March 22, 2004 1:18:50 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22355 March 22, 2004 1:18:53 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22356 March 22, 2004 1:18:55 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22711 March 22, 2004 1:18:59 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21075 March 22, 2004 1:18:59 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21082 March 22, 2004 1:19:00 PM Unrecognized access from 24.67.253.203:8080 to TCP port 20943 March 22, 2004 1:19:05 PM Unrecognized access from 24.67.253.204:8080 to TCP port 5095 March 22, 2004 1:19:06 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21080 March 22, 2004 1:19:10 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22711 March 22, 2004 1:19:12 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22355 March 22, 2004 1:19:17 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21074 March 22, 2004 1:19:19 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22356 March 22, 2004 1:19:25 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21078 March 22, 2004 1:19:27 PM Unrecognized access from 24.71.203.126:3920 to TCP port 445 March 22, 2004 1:19:30 PM Unrecognized access from 24.71.203.126:3920 to TCP port 445 March 22, 2004 1:19:32 PM Unrecognized access from 200.248.119.48:64849 to UDP port 137 March 22, 2004 1:19:32 PM Unrecognized access from 24.67.253.203:8080 to TCP port 20943 March 22, 2004 1:19:37 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21064 March 22, 2004 1:19:38 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22711 March 22, 2004 1:19:57 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22355 March 22, 2004 1:20:04 PM Unrecognized access from 24.67.253.203:8080 to TCP port 20943 March 22, 2004 1:20:10 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22356 March 22, 2004 1:20:36 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21080 March 22, 2004 1:20:36 PM Unrecognized access from 24.67.253.203:8080 to TCP port 20943 March 22, 2004 1:20:36 PM Unrecognized access from 24.67.253.203:8080 to TCP port 22711 March 22, 2004 1:20:36 PM Unrecognized access from 24.67.253.203:8080 to TCP port 21083

Thats everything my router blocked lately. Am I being attacked? Is this bad? Is this normal? --Teh 1337 Hax0r Make MMORPGs Carry Out Your Dreams! Original post by Oluseyi I swear, some of you act as if GameDev were a universal clearinghouse...

DakeDesu

149

DakeDesu

Mar 22, 2004 at 3:28 PM

Lets see... from memory... *thinks*

Those appear to be trojan ports. You haven''t been stupid enough to instal warez on your computer have you?

vNistelrooy

Mar 22, 2004 at 3:30 PM

Oh sorry, it was your computer?! Man what a coincidense... *rollseyes*

"C lets you shoot yourself in the foot rather easily. C++ allows you to reuse the bullet!"

Nervo

101

Nervo

Mar 22, 2004 at 3:31 PM

connections to port 135 is most likely an exploit.

DakeDesu

149

DakeDesu

Mar 22, 2004 at 3:40 PM

If they are exploits (the trojan thing was me trying to remember an entire list of trojan ports from memory) do not worry about being attacked.

The most likely thing is they are some manner of wyrm or virus, and the user "attacking" probably is not aware they are a zombie. When I ran that (really bad) webserver, I noticed a lot of similar things in my log. Including the idiot wyrm CodeRed (which you''d think would atleast make an attempt to verify the server _is_ an MS IISv5 server before trying to infect it)

Simple defenses are, to make sure you run the latest version of all your software (patched up to a "t"), and avoid software you know has a reputation of being insecure (like Warez, Outlook, IIS, sendmail, and a whole host of others).

Zul

156

Zul

Mar 22, 2004 at 3:40 PM

quote:
Original post by Nervo
connections to port 135 is most likely an exploit.

Windows Media Encoder uses that port too. But that''s probably not what''s going on.

aftermath

Mar 22, 2004 at 3:40 PM

Your router (firewall) is blocking the access, so as long it is not melting you are fine... its being blocked.

Umbongo

Mar 22, 2004 at 3:43 PM

I find your name ironic.

DakeDesu

149

DakeDesu

Mar 22, 2004 at 3:47 PM

quote:
Original post by Umbongo
I find your name ironic.

How do you find my badly translated American Slang to the Nihongo equivilent of Engrish ironic?

(Yes, I do know what you mean... I really wish people would become 1337Haxors before making their name reflect such)

1337Haxor

Author

1337Haxor

Mar 22, 2004 at 3:51 PM

quote:
Original post by DakeDesu
quote:
Original post by Umbongo
I find your name ironic.

How do you find my badly translated American Slang to the Nihongo equivilent of Engrish ironic?

(Yes, I do know what you mean... I really wish people would become 1337Haxors before making their name reflect such)

Yeah, I am far from a 1337haxor.....either way... I knew it wasn''t a big deal ''cause my router was blocking it, it just seemed odd that that many would happen over such a short time period.

--Teh 1337 Hax0r
Make MMORPGs Carry Out Your Dreams!
Original post by Oluseyi
I swear, some of you act as if GameDev were a universal clearinghouse...

DakeDesu

149

DakeDesu

Mar 22, 2004 at 3:54 PM

What manner of ISP are you on?

If it is a form of Cable or DSL, certain viruses have been known to have their algorthems follow IPs that most likely will be a Cable or DSL customer.

If you are on an OC3 line, I suggest you stop getting your connection from your college or university before your fridge is hacked. (Yes, University "ISP" are notorious for troublemakers)

1337Haxor

Author

1337Haxor

Mar 22, 2004 at 4:05 PM

quote:
Original post by DakeDesu
What manner of ISP are you on?

If it is a form of Cable or DSL, certain viruses have been known to have their algorthems follow IPs that most likely will be a Cable or DSL customer.

If you are on an OC3 line, I suggest you stop getting your connection from your college or university before your fridge is hacked. (Yes, University "ISP" are notorious for troublemakers)

My fridge? Either way I am on cable.

--Teh 1337 Hax0r
Make MMORPGs Carry Out Your Dreams!
Original post by Oluseyi
I swear, some of you act as if GameDev were a universal clearinghouse...

DakeDesu

149

DakeDesu

Mar 22, 2004 at 4:07 PM

quote:
Original post by 1337Haxor
quote:
Original post by DakeDesu
What manner of ISP are you on?

If it is a form of Cable or DSL, certain viruses have been known to have their algorthems follow IPs that most likely will be a Cable or DSL customer.

If you are on an OC3 line, I suggest you stop getting your connection from your college or university before your fridge is hacked. (Yes, University "ISP" are notorious for troublemakers)
My fridge? Either way I am on cable.

Er, yeah... it was a joke that I think originated from a ClanBob comic.

griffenjam

133

griffenjam

Mar 22, 2004 at 4:08 PM

The only worrying thing is all the connection attempts made by the same IP address, however since they are all done so fast it seems that it is a script that is doing it. If that''s the case I doubt that anyone is targeting you, they are just looking for someone that has already been hacked so they can feel like 1337 hackers and pretend that they hack a computer in front of their friends, when they only really went through an already open door.

In other words.....WELCOME TO THE INTERNET...this happens 100-1000 times a day to me.

"The paths of glory lead but to the grave." - Thomas Gray
I kick ass, my URL says so.
My Online Photo Gallery

Senses777

123

Senses777

Mar 22, 2004 at 4:34 PM

Test your internet security here:
https://grc.com/x/ne.dll?bh0bkyd2

Nervo

101

Nervo

Mar 22, 2004 at 4:35 PM

tsk tsk, a perfectly good name gone to waste. BTW, who WAS the self-proclaimed "h4x0r AOLd00d"?

Zul

156

Zul

Mar 22, 2004 at 4:40 PM

That guy got banned, but if anyone else is curious, it appears that port 135 is a security exploit on some Windows OS''s. Here''s a little tidbit about it:

Report from Cox

He probably just had some zombies pinging him to see if he had that port open, but he didn''t so he''s ok.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.