[Snort-sigs] [Emerging-Sigs] Attack from .jp IPs

Jason Wallace jason.r.wallace at ...2420...
Tue Dec 7 10:26:39 EST 2010


.jp address on Pearl Harbor Day? That is a little to coincidental
IMO... Especially since one of the ports is 1941...

On Tue, Dec 7, 2010 at 10:18 AM, L0rd Ch0de1m0rt
<l0rdch0de1m0rt at ...2420...> wrote:
> Hello, almost exactly at 7:41 AM this morning multiple servers in my
> enterprise are under attack by DDoS with TCP Zeroes-window size
> destined to port 1941 and 1207, the hosts appear to resolve PTR as
> hideki.tojo.jp, isoroku.yamamoto.jp, tomoyuki.yamashita.jp, and more.
> Is anyone else seeing this?
>
> Thanks.
>
> -L0rd C.
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at ...3335...
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>
> Support Emerging Threats! Subscribe to Emerging Threats Pro http://www.emergingthreatspro.com
> The ONLY place to get complete premium rulesets for Snort 2.4.0 through Current!
>




More information about the Snort-sigs mailing list