[Gllug] More coordinated attacks

[Mark Hill]

On Sat, 17 Jul 2004 10:35:48 +0100,
Richard Jones <rich at annexia.org> wrote:
>
> This surely indicates some script kiddie actually directing a load of
> zombie machines to attack the site?  Or is this a centrally
> controlled, but automated attack?

It looks a lot, if not all, of those ips are running running http(s)
servers. Maybe this has some connection to the attack?

I tried out the following. Out of the 13 IPs, 9 were up:

cat yourlogoutput.txt | cut -d ' ' -f 8 | sed s/\\]// | \
nmap -p80,443,25 -iL - > results.txt
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug