Likes: 
Incident Detail
Incident ID: 42609379 Source IP: 212.123.24.90
Provider Domain: telenet-ops.be
DNS Name: 212-123-24-90.iFiber.telenet-ops.be
Total Event Count : 50 Total Distinct Agent: 24/1500
Response : No Response
Status Description: Escalated
Exclusion Reason :
Network Name/NextNIC Start IP - End IP
RIPE-NCC-212/RIPE 212.0.0.0 - 212.255.255.255
TELENET/DUMMY 212.123.22.0 - 212.123.31.255
NextNIC:99999
Whois provider: telenet.be
% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-serv...copyright.html
inetnum: 212.123.22.0 - 212.123.31.255
netname: TELENET
descr: Telenet Operaties N.V.
country: BE
admin-c: PS396-RIPE
tech-c: PS396-RIPE
status: ASSIGNED PA
mnt-by: TELENET-DBM
mnt-lower: TELENET-DBM
changed: tech@telenet-ops.be 20010315
source: RIPE
route: 212.123.16.0/20
descr: TELENET
origin: AS6848
mnt-by: TELENET-OPS-MNT
changed: michel.vanlandschoote@telenet.be 20010618
source: RIPE
role: Technical Internet
address: Telenet Operaties N.V.
address: Liersesteenweg 4
address: B-2800 Mechelen
address: Belgium
e-mail: tech@telenet-ops.be
trouble: IMPORTANT: To report intrusion attempts, hacking,
trouble: IMPORTANT: spamming, or other unaccepted behavior
trouble: IMPORTANT: by a Telenet/Pandora customer, please
trouble: IMPORTANT: send a message to abuse@pandora.be
trouble: IMPORTANT: Voor het rapporteren van inbraakpogingen,
trouble: IMPORTANT: hacking, spamming, of ander onaanvaardbaar
trouble: IMPORTANT: gedrag van een Telenet/Pandora klant, gelieve
trouble: IMPORTANT: een bericht te zenden naar abuse@pandora.be
admin-c: TI346-ORG
tech-c: TI346-ORG
nic-hdl: PS396-RIPE
mnt-by: TELENET-DBM
changed: tech@telenet-ops.be 20000630
source: RIPE
Most Recent Event
Date/Time
(UTC) Agent Alias Agent Type Log Type Target IP # of IPs
Targeted IP
Protocol Target
Port Port/
Issue Description Source
Port Explanation Event
Count
3 Nov 2003 04:15:26 jankemi Perl Cisco PIX 134.29.x.x 52 6 80 HTTP
Possible Nachi/CodeRed/Nimda 4578 mNW Info 156
30 Oct 2003 12:05:34 SWIZ win32 Zone Alarm 66.115.x.x 1 1 8 ICMP
Echo Request
Possible Nachi/Welchia Infection 0 mNW Info 1
28 Oct 2003 08:27:03 Zotz Perl iptables 63.105.x.x 1 6 135 DCE
endpoint resolution
Msblast/Nachi? 22505 mNW Info 2
28 Oct 2003 07:28:12 proalias Perl NetGear 63.105.x.x 1 6 135 DCE
endpoint resolution
Msblast/Nachi? 35600 mNW Info 1
25 Oct 2003 17:15:05 snet00003 Perl SentiNet 192.52.x.x 3 6 135
DCE endpoint resolution
Msblast/Nachi? 65535 mNW Info 5
23 Oct 2003 11:46:32 TTSD Perl iptables 212.241.x.x 1 6 135 DCE
endpoint resolution
Msblast/Nachi? 25686 mNW Info 1
23 Oct 2003 07:19:00 Giga Wizard win32 Dlink/SMC 212.239.x.x 1 6
135 DCE endpoint resolution
Msblast/Nachi? 50563 mNW Info 1
23 Oct 2003 05:01:18 gwolting win32 Zone Alarm 212.238.x.x 1 6 135
DCE endpoint resolution
Msblast/Nachi? 12179 mNW Info 1
22 Oct 2003 15:28:26 sidious777 win32 Zone Alarm 63.155.x.x 1 1 8
ICMP Echo Request
Possible Nachi/Welchia Infection 0 mNW Info 1
21 Oct 2003 16:21:54 rubberduckie win32 BlackICE 66.147.x.x 1 6 80
HTTP
HTTP port probe 29052 advICE | mNW Info 3
21 Oct 2003 12:52:58 thoreau win32 Zone Alarm 156.34.x.x 1 1 8
ICMP Echo Request
Possible Nachi/Welchia Infection 0 mNW Info 1
17 Oct 2003 12:09:12 Readytek Perl Cisco PIX 63.226.x.x 8 6 80
HTTP
Possible Nachi/CodeRed/Nimda 5786 mNW Info 22
16 Oct 2003 21:47:28 Speeddy win32 Zone Alarm 24.206.x.x 1 6 135
DCE endpoint resolution
Msblast/Nachi? 65274 mNW Info 1
16 Oct 2003 17:45:16 Ohpaus win32 WallWatch 24.204.x.x 1 6 135 DCE
endpoint resolution
Msblast/Nachi? 3698 mNW Info 1
15 Oct 2003 08:12:44 rsiddall Perl ipchains 66.51.x.x 2 6 135 DCE
endpoint resolution
Msblast/Nachi? 13844 mNW Info 6
13 Oct 2003 07:17:56 cacroll win32 WallWatch 209.204.x.x 1 6 135
DCE endpoint resolution
Msblast/Nachi? 12416 mNW Info 2
12 Oct 2003 13:54:58 Dilvish win32 Zone Alarm 65.48.x.x 1 1 8 ICMP
Echo Request
Possible Nachi/Welchia Infection 0 mNW Info 3
11 Oct 2003 10:25:38 Ron Kwong win32 Zone Alarm 202.40.x.x 1 1 8
ICMP Echo Request
Possible Nachi/Welchia Infection 0 mNW Info 3
27 Sep 2003 23:52:20 eager win32 Zone Alarm 66.56.x.x 1 1 8 ICMP
Echo Request
Possible Nachi/Welchia Infection 0 mNW Info 1
27 Sep 2003 17:19:27 CheezWiz win32 Dlink/SMC 170.215.x.x 1 6 135
DCE endpoint resolution
Msblast/Nachi? 51212 mNW Info 1
26 Sep 2003 06:57:34 pmws win32 Zone Alarm 80.1.x.x 2 6 135 DCE
endpoint resolution
Msblast/Nachi? 16350 mNW Info 2
19 Sep 2003 17:11:48 nailedsaviour win32 MS ICF 203.45.x.x 1 1 8
ICMP Echo Request
Possible Nachi/Welchia Infection 65535 mNW Info 1
16 Sep 2003 04:35:58 jankemi Perl Cisco PIX 134.29.x.x 35 6 135
DCE endpoint resolution
Msblast/Nachi? 1488 mNW Info 103
14 Sep 2003 10:37:59 Olen Perl iptables 195.159.x.x 2 6 135 DCE
endpoint resolution
Msblast/Nachi? 21504 mNW Info 4
10 Sep 2003 22:23:28 sdr515 win32 Zone Alarm 65.128.x.x 1 1 8 ICMP
Echo Request
Possible Nachi/Welchia Infection 0 mNW Info 1
10 Sep 2003 13:45:02 jfscesd win32 Cisco PIX 198.237.x.x 1 1 8
ICMP Echo Request
Possible Nachi/Welchia Infection 65535 mNW Info 1
3 Sep 2003 14:53:43 CBN Net Perl Snort 202.158.x.x 1 6 135 DCE
endpoint resolution
Msblast/Nachi? 57569 mNW Info 2
Quote
