From owner-freebsd-security Mon May 24 7:58:55 1999 Delivered-To: freebsd-security@freebsd.org Received: from adelphi.physics.adelaide.edu.au (adelphi.physics.adelaide.edu.au [129.127.36.247]) by hub.freebsd.org (Postfix) with ESMTP id A9EF514E89 for ; Mon, 24 May 1999 07:58:51 -0700 (PDT) (envelope-from kkennawa@physics.adelaide.edu.au) Received: from bragg (bragg [129.127.36.34]) by adelphi.physics.adelaide.edu.au (8.8.8/8.8.8/UofA-1.5) with SMTP id AAA23108; Tue, 25 May 1999 00:28:50 +0930 (CST) Received: from localhost by bragg; (5.65/1.1.8.2/05Aug95-0227PM) id AA03461; Tue, 25 May 1999 00:29:42 +0930 Date: Tue, 25 May 1999 00:29:42 +0930 (CST) From: Kris Kennaway X-Sender: kkennawa@bragg To: Joao Assad Cc: freebsd-security@freebsd.org Subject: Re: Denial of service attack from "imagelock.com" In-Reply-To: <37492DE5.2822267@domain.com.br> Message-Id: Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, 24 May 1999, Joao Assad wrote: > > The Webmasters on this list may want to look over their logs to see > > if they've been hit and not known it. grep your logs for imagelock.com; > > if you find that they're abusing your server, you may want to firewall > > them out and complain to ABOVE.NET. > > Damn they scanned all my servers, I didnt check before because I though they > wouldnt be interested in a .br server.... Seems like they got here coming > through > our tucows mirror and once they got in our network they started scanning all > our > servers. 750 hits on one of my small web servers last night. Didn't check the others yet.. Kris ----- "Never criticize anybody until you have walked a mile in their shoes, because by that time you will be a mile away and have their shoes." -- Unknown To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message