All pastes #1851922 Raw Edit

220.161.207.62 attacker caught b

public text v1 · immutable
#1851922 ·published 2010-03-24 22:42 UTC
rendered paste body
Type  	 	Date/Time  	 	Event Description
INF 		2010-03-23T05:28:27-06:00 		fw,fwmon:  src=69.171.164.195 dst=75.23.68.219 ipprot=17 sport=12082 dport=3377 Unknown inbound session stopped
INF 		2010-03-23T05:29:23-06:00 		fw,fwmon:  src=61.158.143.121 dst=75.23.68.219 ipprot=6 sport=6000 dport=2967 Unknown inbound session stopped
INF 		2010-03-23T05:29:34-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:29:54-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:29:56-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:31:52-06:00 		fw,fwmon:  src=69.171.164.195 dst=75.23.68.219 ipprot=17 sport=14402 dport=3377 Unknown inbound session stopped
INF 		2010-03-23T05:38:08-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:38:26-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:38:28-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:45:55-06:00 		fw,fwmon:  src=192.171.171.254 dst=75.23.68.219 ipprot=6 sport=55392 dport=25 Unknown inbound session stopped
INF 		2010-03-23T05:46:39-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:46:57-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:47:00-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:55:12-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:55:28-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T05:55:33-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:03:43-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:04:00-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:04:04-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:07:16-06:00 		fw,fwmon:  src=115.89.24.180 dst=75.23.68.219 ipprot=6 sport=12200 dport=9415 Unknown inbound session stopped
INF 		2010-03-23T06:12:17-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:12:34-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:12:36-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:19:45-06:00 		fw,fwmon:  src=125.99.1.51 dst=75.23.68.219 ipprot=17 sport=9998 dport=3377 Unknown inbound session stopped
INF 		2010-03-23T06:20:51-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:21:06-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:21:08-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:24:50-06:00 		fw,fwmon:  src=221.192.199.35 dst=75.23.68.219 ipprot=6 sport=12200 dport=8000 Unknown inbound session stopped
INF 		2010-03-23T06:27:05-06:00 		fw,fwmon:  src=221.192.199.35 dst=75.23.68.219 ipprot=6 sport=12200 dport=80 Unknown inbound session stopped
INF 		2010-03-23T06:29:23-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:29:38-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:29:42-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:30:51-06:00 		fw,fwmon:  src=41.204.63.204 dst=75.23.68.219 ipprot=6 sport=64329 dport=21 Unknown inbound session stopped
		2010-03-23T06:30:54-06:00 		Previous log entry repeated 1 times
INF 		2010-03-23T06:32:50-06:00 		fw,fwmon:  src=91.117.56.51 dst=75.23.68.219 ipprot=17 sport=14154 dport=39387 Unknown inbound session stopped
INF 		2010-03-23T06:37:56-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:38:12-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:38:15-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:46:28-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:46:45-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:46:48-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:47:39-06:00 		fw,fwmon:  src=66.203.212.17 dst=75.23.68.219 ipprot=17 sport=16895 dport=3377 Unknown inbound session stopped
INF 		2010-03-23T06:53:15-06:00 		fw,fwmon:  src=88.186.17.123 dst=75.23.68.219 ipprot=17 sport=37977 dport=3377 Unknown inbound session stopped
INF 		2010-03-23T06:54:30-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64779 dport=515 Unknown inbound session stopped
INF 		2010-03-23T06:54:30-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64780 dport=9100 Unknown inbound session stopped
NTC 		2010-03-23T06:54:30-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64781 dport=2191 TCP Port Scan Detected
INF 		2010-03-23T06:54:30-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64781 dport=2191 Unknown inbound session stopped
INF 		2010-03-23T06:54:30-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64782 dport=80 Unknown inbound session stopped
INF 		2010-03-23T06:54:30-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64783 dport=443 Unknown inbound session stopped
INF 		2010-03-23T06:54:30-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64784 dport=81 Unknown inbound session stopped
INF 		2010-03-23T06:54:33-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64779 dport=515 Unknown inbound session stopped
INF 		2010-03-23T06:54:33-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64780 dport=9100 Unknown inbound session stopped
NTC 		2010-03-23T06:54:33-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64782 dport=80 TCP Port Scan Detected
INF 		2010-03-23T06:54:33-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64782 dport=80 Unknown inbound session stopped
INF 		2010-03-23T06:54:33-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64783 dport=443 Unknown inbound session stopped
INF 		2010-03-23T06:54:33-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64781 dport=2191 Unknown inbound session stopped
INF 		2010-03-23T06:54:33-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64784 dport=81 Unknown inbound session stopped
INF 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64779 dport=515 Unknown inbound session stopped
INF 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64780 dport=9100 Unknown inbound session stopped
NTC 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64782 dport=80 TCP Port Scan Detected
INF 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64782 dport=80 Unknown inbound session stopped
INF 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64781 dport=2191 Unknown inbound session stopped
INF 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64783 dport=443 Unknown inbound session stopped
INF 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64784 dport=81 Unknown inbound session stopped
INF 		2010-03-23T06:55:01-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:55:16-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:55:20-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:03:32-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:03:49-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:03:53-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:04:55-06:00 		fw,fwmon:  src=220.162.207.62 dst=75.23.68.219 ipprot=6 sport=64331 dport=3128 Unknown inbound session stopped
INF 		2010-03-23T07:04:55-06:00 		fw,fwmon:  src=220.162.207.62 dst=75.23.68.219 ipprot=6 sport=64330 dport=8080 Unknown inbound session stopped
INF 		2010-03-23T07:04:58-06:00 		fw,fwmon:  src=220.162.207.62 dst=75.23.68.219 ipprot=6 sport=64331 dport=3128 Unknown inbound session stopped
INF 		2010-03-23T07:04:58-06:00 		fw,fwmon:  src=220.162.207.62 dst=75.23.68.219 ipprot=6 sport=64330 dport=8080 Unknown inbound session stopped
INF 		2010-03-23T07:12:04-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:12:20-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:12:24-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:12:38-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.171.164.195 ipprot=1 icmp_type=8 icmp_code=0 Packet Dropped
INF 		2010-03-23T07:12:38-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.171.164.195 ipprot=1 icmp_type=13 icmp_code=0 Packet Dropped
		2010-03-23T07:12:40-06:00 		Previous log entry repeated 1 times
INF 		2010-03-23T07:12:40-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.171.164.195 ipprot=1 icmp_type=8 icmp_code=0 Packet Dropped
INF 		2010-03-23T07:13:19-06:00 		fw,fwmon:  src=97.95.56.139 dst=75.23.68.219 ipprot=17 sport=30285 dport=3377 Unknown inbound session stopped
INF 		2010-03-23T07:13:53-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.171.164.195 ipprot=6 sport=2995 dport=14402 Packet Dropped
INF 		2010-03-23T07:11:56-06:00 		sys:  Successfully logged into a password protected page
INF 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64782 dport=80 Unknown inbound session stopped
INF 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64781 dport=2191 Unknown inbound session stopped
INF 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64783 dport=443 Unknown inbound session stopped
INF 		2010-03-23T06:54:39-06:00 		fw,fwmon:  src=75.23.68.195 dst=75.23.68.219 ipprot=6 sport=64784 dport=81 Unknown inbound session stopped
INF 		2010-03-23T06:55:01-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:55:16-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T06:55:20-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:03:32-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:03:49-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:03:53-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:04:55-06:00 		fw,fwmon:  src=220.162.207.62 dst=75.23.68.219 ipprot=6 sport=64331 dport=3128 Unknown inbound session stopped
INF 		2010-03-23T07:04:55-06:00 		fw,fwmon:  src=220.162.207.62 dst=75.23.68.219 ipprot=6 sport=64330 dport=8080 Unknown inbound session stopped
INF 		2010-03-23T07:04:58-06:00 		fw,fwmon:  src=220.162.207.62 dst=75.23.68.219 ipprot=6 sport=64331 dport=3128 Unknown inbound session stopped
INF 		2010-03-23T07:04:58-06:00 		fw,fwmon:  src=220.162.207.62 dst=75.23.68.219 ipprot=6 sport=64330 dport=8080 Unknown inbound session stopped
INF 		2010-03-23T07:12:04-06:00 		fw,fwmon:  src=192.168.1.65 dst=198.186.191.229 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:12:20-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.94.105.81 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:12:24-06:00 		fw,fwmon:  src=192.168.1.65 dst=70.85.30.20 ipprot=17 sport=123 dport=123 Packet Dropped
INF 		2010-03-23T07:12:38-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.171.164.195 ipprot=1 icmp_type=8 icmp_code=0 Packet Dropped
INF 		2010-03-23T07:12:38-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.171.164.195 ipprot=1 icmp_type=13 icmp_code=0 Packet Dropped
		2010-03-23T07:12:40-06:00 		Previous log entry repeated 1 times
INF 		2010-03-23T07:12:40-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.171.164.195 ipprot=1 icmp_type=8 icmp_code=0 Packet Dropped
INF 		2010-03-23T07:13:19-06:00 		fw,fwmon:  src=97.95.56.139 dst=75.23.68.219 ipprot=17 sport=30285 dport=3377 Unknown inbound session stopped
INF 		2010-03-23T07:13:53-06:00 		fw,fwmon:  src=192.168.1.65 dst=69.171.164.195 ipprot=6 sport=2995 dport=14402 Packet Dropped

hois

Details on IP address 220.162.207.62

% [whois.apnic.net node-3]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:      220.160.0.0 - 220.162.255.255
netname:      CHINANET-FJ
descr:        CHINANET Fujian province network
descr:        Data Communication Division
descr:        China Telecom
country:      CN
admin-c:      CH93-AP
tech-c:       CA67-AP
mnt-by:       MAINT-CHINANET
mnt-lower:    MAINT-CHINANET-FJ
changed:      hostmaster@ns.chinanet.cn.net 20021025
status:       ALLOCATED NON-PORTABLE
source:       APNIC

role:         CHINANETFJ IP ADMIN
address:      7,East Street,Fuzhou,Fujian,PRC
country:      CN
phone:        +86-591-83309761
fax-no:       +86-591-83371954
e-mail:       fjnic@fjdcb.fz.fj.cn
trouble:      send spam reports  and abuse reports
trouble:      to abuse@fjdcb.fz.fj.cn
trouble:      Please include detailed information and
trouble:      times in UTC
admin-c:      FH71-AP
tech-c:       FH71-AP
nic-hdl:      CA67-AP
remarks:      www.fjtelecom.com
notify:       fjnic@fjdcb.fz.fj.cn
mnt-by:       MAINT-CHINANET-FJ
changed:      fjnic@fjdcb.fz.fj.cn 20100108
source:       APNIC

person:       Chinanet Hostmaster
nic-hdl:      CH93-AP
e-mail:       anti-spam@ns.chinanet.cn.net
address:      No.31 ,jingrong street,beijing
address:      100032
phone:        +86-10-58501724
fax-no:       +86-10-58501724
country:      CN
changed:      dingsy@cndata.com 20070416
mnt-by:       MAINT-CHINANET
source:       APNIC



220.162.207.62 Isn't hacking anymore though thanks to dd-wrt, then I'm setting up a smoothwall box ,and perhaps investing in a watchguard.. good luck to them. I hope they are getting hacked back because eventually I'm going to setup so many proxy servers and start issuing SYN flood attacks from Fiber Optic lines.. 

If you have any questions feel free to email me at $clintburford@gmail.com$  NOTE: Any spam will be forwarded to spam@uce.gov 

Thank You