North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Very peculiar Telnet probing (possibly spoofed?)

  • From: Suresh Ramasubramanian
  • Date: Thu Sep 09 01:56:14 2004

Jeff Kell wrote:
I'm getting attacks from:

159.226.x.x
202.x.x.x
203.x.x.x

These /8s are shared between a whole lot of different ISPs in different countries.

Do the machines trying this typically look like botnets, or open proxies?

Do you notice any other traffic (malicious or otherwise) from these IPs immediately before or after these telnet probes?

srs