New Script Kiddie tool ?

[Peter Robinson <peter () securegateway org>]

G/Day all

Has any one seem this sort of probe ??

It apears from all over the place and it seems to be spaced exactly 10 
seconds appart.

I am assuming this is a tool of sorts..


Source Address=208.184.139.82
        Aug 22 14:04:21 Firewall 208.184.139.82 61.x.x.x----ICMP TYPE=8
        Aug 22 14:04:31 Firewall 208.184.139.82 61.x.x.x----ICMP TYPE=8
        Aug 22 14:04:41 Firewall 208.184.139.82 61.x.x.x----ICMP TYPE=8
        Aug 22 14:04:51 Firewall 208.184.139.82 61.x.x.x----UDP 53
        Aug 22 14:05:01 Firewall 208.184.139.82 61.x.x.x----UDP 53
        Aug 22 17:00:03 Firewall 208.184.139.82 61.x.x.x----ICMP TYPE=8
        Aug 22 17:00:13 Firewall 208.184.139.82 61.x.x.x----ICMP TYPE=8
        Aug 22 17:00:23 Firewall 208.184.139.82 61.x.x.x----ICMP TYPE=8
        Aug 22 17:00:33 Firewall 208.184.139.82 61.x.x.x----UDP 53
        Aug 22 17:00:43 Firewall 208.184.139.82 61.x.x.x----UDP 53
 
Source Address=208.185.54.14
        Aug 22 14:04:21 Firewall 208.185.54.14 61.x.x.x----ICMP TYPE=8
        Aug 22 14:04:32 Firewall 208.185.54.14 61.x.x.x----ICMP TYPE=8
        Aug 22 14:04:42 Firewall 208.185.54.14 61.x.x.x----ICMP TYPE=8
        Aug 22 14:04:52 Firewall 208.185.54.14 61.x.x.x----UDP 53
        Aug 22 14:05:02 Firewall 208.185.54.14 61.x.x.x----UDP 53
        Aug 22 15:53:32 Firewall 208.185.54.14 61.x.x.x----ICMP TYPE=8
        Aug 22 15:53:42 Firewall 208.185.54.14 61.x.x.x----ICMP TYPE=8
        Aug 22 15:53:52 Firewall 208.185.54.14 61.x.x.x----ICMP TYPE=8
        Aug 22 15:54:02 Firewall 208.185.54.14 61.x.x.x----UDP 53
        Aug 22 15:54:12 Firewall 208.185.54.14 61.x.x.x----UDP 53
        Aug 22 17:00:02 Firewall 208.185.54.14 61.x.x.x----ICMP TYPE=8
        Aug 22 17:00:12 Firewall 208.185.54.14 61.x.x.x----ICMP TYPE=8
        Aug 22 17:00:22 Firewall 208.185.54.14 61.x.x.x----ICMP TYPE=8
        Aug 22 17:00:32 Firewall 208.185.54.14 61.x.x.x----UDP 53
        Aug 22 17:00:42 Firewall 208.185.54.14 61.x.x.x----UDP 53
 
Source Address=208.225.197.194
        Aug 22 15:53:35 Firewall 208.225.197.194 61.x.x.x----ICMP TYPE=8
        Aug 22 15:53:45 Firewall 208.225.197.194 61.x.x.x----ICMP TYPE=8
        Aug 22 15:53:55 Firewall 208.225.197.194 61.x.x.x----ICMP TYPE=8
        Aug 22 15:54:05 Firewall 208.225.197.194 61.x.x.x----UDP 53
        Aug 22 15:54:15 Firewall 208.225.197.194 61.x.x.x----UDP 53
 
Source Address=208.254.18.130
        Aug 22 15:53:31 Firewall 208.254.18.130 61.x.x.x----ICMP TYPE=8
        Aug 22 15:53:41 Firewall 208.254.18.130 61.x.x.x----ICMP TYPE=8
        Aug 22 15:53:51 Firewall 208.254.18.130 61.x.x.x----ICMP TYPE=8
        Aug 22 15:54:02 Firewall 208.254.18.130 61.x.x.x----UDP 53
        Aug 22 15:54:11 Firewall 208.254.18.130 61.x.x.x----UDP 53
 
Source Address=208.254.75.130
        Aug 22 15:53:32 Firewall 208.254.75.130 61.x.x.x----ICMP TYPE=8
        Aug 22 15:53:42 Firewall 208.254.75.130 61.x.x.x----ICMP TYPE=8
        Aug 22 15:53:52 Firewall 208.254.75.130 61.x.x.x----ICMP TYPE=8
        Aug 22 15:54:02 Firewall 208.254.75.130 61.x.x.x----UDP 53
        Aug 22 15:54:12 Firewall 208.254.75.130 61.x.x.x----UDP 

Peter Robinson
Senior Security Engineer - Sydney
DeMorgan Information Security Specialists
robinson_p () demorgan com au, www.demorgan.com.au, 
Tel.    1800 336 674
Tel.    +61 2 9929-0377
Fax     +61 2 9499 4885


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards