full-disclosure - Shockwave2 scans?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: jlay at ameriben.com (James Lay)
Subject: Shockwave2 scans?

Umm..ok...just saw this about 5 minutes ago:

Feb  6 11:10:53 gateway kernel: Web1 drops:IN=br0 OUT=br0 PHYSIN=eth1
PHYSOUT=eth0 SRC=63.111.197.241 DST=10.1.18.1 LEN=48 TOS=0x00 PREC=0x00
TTL=114 ID=26974 DF PROTO=TCP SPT=62295 DPT=1257 WINDOW=65535 RES=0x00 SYN
URGP=0  
Feb  6 11:10:53 gateway kernel: Web drops:IN=br0 OUT=br0 PHYSIN=eth1
PHYSOUT=eth0 SRC=63.111.197.241 DST=10.1.19.1 LEN=48 TOS=0x00 PREC=0x00
TTL=114 ID=26975 DF PROTO=TCP SPT=62296 DPT=1257 WINDOW=65535 RES=0x00 SYN
URGP=0  
Feb  6 11:10:53 gateway kernel: Web drops:IN=br0 OUT=br0 PHYSIN=eth1
PHYSOUT=eth0 SRC=63.111.197.241 DST=10.1.19.2 LEN=48 TOS=0x00 PREC=0x00
TTL=114 ID=26976 DF PROTO=TCP SPT=62297 DPT=1257 WINDOW=65535 RES=0x00 SYN
URGP=0  
Feb  6 11:10:53 gateway kernel: Web drops:IN=br0 OUT=br0 PHYSIN=eth1
PHYSOUT=eth0 SRC=63.111.197.241 DST=10.1.19.4 LEN=48 TOS=0x00 PREC=0x00
TTL=114 ID=26977 DF PROTO=TCP SPT=62298 DPT=1257 WINDOW=65535 RES=0x00 SYN
URGP=0  
Feb  6 11:10:53 gateway kernel: Web drops:IN=br0 OUT=br0 PHYSIN=eth1
PHYSOUT=eth0 SRC=63.111.197.241 DST=10.1.19.7 LEN=48 TOS=0x00 PREC=0x00
TTL=116 ID=26979 DF PROTO=TCP SPT=62300 DPT=1257 WINDOW=65535 RES=0x00 SYN
URGP=0  
Feb  6 11:10:53 gateway snort: Portscan detected from 63.111.197.241
Talker(fixed: 0 sliding: 0) Scanner(fixed: 5 sliding: 5)

That's just a segment of the total scan...anyone else seeing this?

James Lay
Network Manager/Security Officer
AmeriBen Solutions/IEC Group
Semper Vigilans!!!