IWETHEY v. 0.3.0 | TODO
1,095 registered users | 0 active users | 0 LpH | Statistics
Login | Create New User
IWETHEY Banner

Welcome to IWETHEY!

IWETHEY Home / IWETHEY Board / Security Forum / Update: Since 24th blocking seems to have stopped ?
Post #71,296
by dmarker
Picture of dmarker
12/29/02 6:33:32 AM
12/29/02 6:50:50 AM
Reply
New Update: Since 24th blocking seems to have stopped ?
The bursts of port scanning after doig a post ahve also stopped ?

Am back to using the primary computers that in the past were unable to post.

Hmmm, sure hope it stays this way - was a pain-in-ass trying to get round it.

Cheers & a happy new year.

Doug


#2 - Hmmm may have been a bit to quick re the scanning having stopped - the log after my last post to WoT shows otherwise Hmmmmm ...

This entry at bottom was a post WoT forum here - there are no port scans before this on todays log. The probes to port 137 are described as an abberation of windows tcp/ip computers seeking to get IDENT of other computers so they are normally considered irrelevant except the first ones come from (or via) the computer (proxy ?) doing the port scans -

29/Dec/2002 19:27:12 Filter 218.102.23.27 --> 218.102.109.246 TCP Port:1140


This is the log immediately after the post... (bottom to top)

29/Dec/2002 19:41:20 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:41:12 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:39:20 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:39:12 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:37:20 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:37:12 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:35:20 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:35:12 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:33:21 Filter 213.104.67.17 --> 218.102.109.246 UDP Port:137 29/Dec/2002 19:33:20 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:33:15 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:32:29 Filter 213.255.134.183 --> 218.102.109.246 UDP Port:137 29/Dec/2002 19:32:28 Filter 203.125.111.166 --> 218.102.109.246 UDP Port:2166 29/Dec/2002 19:32:18 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:32:16 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:31:48 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:31:46 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:31:32 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:31:32 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:31:29 Filter 80.218.7.37 --> 218.102.109.246 UDP Port:137 29/Dec/2002 19:31:25 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:31:24 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:31:21 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:31:21 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:31:19 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50012 29/Dec/2002 19:31:19 Filter 64.236.45.55 --> 218.102.109.246 TCP Port:50013 29/Dec/2002 19:31:05 Filter 217.127.178.124 --> 218.102.109.246 UDP Port:137 29/Dec/2002 19:29:28 Filter 210.85.112.115 --> 218.102.109.246 UDP Port:137 29/Dec/2002 19:27:43 Filter 211.161.235.60 --> 218.102.109.246 UDP Port:137 29/Dec/2002 19:27:12 Filter 218.102.23.27 --> 218.102.109.246 TCP Port:1140
Expand Edited by dmarker Dec. 29, 2002, 06:50:50 AM EST
Expand All History
Post #71,329
by orion
Picture of orion
12/29/02 4:23:18 PM
Reply
New Re: Update: Since 24th blocking seems to have stopped ?
[link|http://z.iwethey.org/forums/render/content/show?contentid=71264|I posted for you in the suggestions forum] and I got blasted for it.

If it was someone in that country you are living in doing the scanning and blocking, it would have continued. Unless it is some script-kiddie trying to see who accesses war on terrorism forums or whatever.

Scott still has not yet replied. Maybe it was a bug and it got fixed now? Maybe your proxy was using a cached version of the page? Maybe someone intercepted the request and put up a fake Zope error?
For an Alternative Nearly To Imitate IWETHEY please visit [link|http://pub75.ezboard.com/bantiiwethey|the ANTIIWETHEY Board]
providing an alternative to IWETHEY since December 2002
Post #71,337
by folkert
Picture of folkert
12/29/02 5:16:29 PM
Reply
New You got blasted for continuing
Your Quest to become a Martyr here.

Remember Doug Marker is in Honk Kong, most connection out of Hong Kong (barring a few) have a transparent "proxy" or traffic "tee".

Mr. Norman "martyr" King... Stop this insinuation of us being dishonorable. It will get you no where but on the butt end of many jokes.
[link|mailto:curley95@attbi.com|greg] - Grand-Master Artist in IT
[link|http://www.iwethey.org/ed_curry/|REMEMBER ED CURRY!]
[link|http://pascal.rockford.com:8888/SSK@kQMsmc74S0Tw3KHQiRQmDem0gAIPAgM/edcurry/1//|ED'S GHOST SPEAKS!]		 Your friendly Geheime Staatspolizei reminds:
[link|http://www.wired.com/news/wireless/0,1382,56742,00.html| Wi-Fi Terrorism] comes with an all inclusive
free trip to the local Hoosegow!
I'll never tell, my *overly-red* lips are sealed! *wink* *wink*
Post #71,417
by orion
Picture of orion
12/30/02 12:49:05 AM
Reply
New I already am the butt of many jokes here
so why bother, just because you say so?

You know it is true that you and others pick on me a lot. Which is why AntiIWETHEY got started.
For an Alternative Nearly To Imitate IWETHEY please visit [link|http://pub75.ezboard.com/bantiiwethey|the ANTIIWETHEY Board]
providing an alternative to IWETHEY since December 2002
Post #71,342
by a6l6e6x
Picture of a6l6e6x
12/29/02 5:41:30 PM
Reply
New Report: Makka is harmless! The investigation is over. :)
Alex
"No man's life, liberty, or property are safe while the legislature is in session."\t-- Mark Twain
Post #71,368
by dmarker
Picture of dmarker
12/29/02 7:33:06 PM
Reply
New Re: Report: Makka is harmless! The investigation is over. :

That is what it seems like to me.

I can't think of any other possibility that combines the barring of posts to WoT followed predicatbly by port scanning (combined with a daily mail feed of virus attachments).

I am hoping it has ended & I can get back to normal. The good thing about this though was it honed my security skills & got me examining all the various firewall & IDS software around. I never had any info on these computers that I couldn't rebuild so was not seriousl fearful of what could happen, just avoiding inconvenience. The other good thing was that at no time was any damage done o any of my machines.

In balance, apart from the odd feeling one gets when one sees evidence of blocking/probing/breakins this has been a valuable education for me. I took a risk in going public on it (those who have never experienced the above can think it is imaginary). But those who believe they know me will know I am usually pretty careful with my facts.

Anyway - start of a new week - am just about to head of to work - have two daughters in NZ who will be producing babies each in the next 10 days - this will make up for losing my mother (who passed away on the 14th Dec). Lose 1 gain 2.

Happy new year & hope 2003 settles down early for all of us.

Cheers Doug
     Update: Since 24th blocking seems to have stopped ? - (dmarker) - (5) - Dec. 29, 2002, 06:50:50 AM EST
         Re: Update: Since 24th blocking seems to have stopped ? - (orion) - (2) - Dec. 29, 2002, 04:23:18 PM EST
             You got blasted for continuing - (folkert) - (1) - Dec. 29, 2002, 05:16:29 PM EST
                 I already am the butt of many jokes here - (orion) - Dec. 30, 2002, 12:49:05 AM EST
         Report: Makka is harmless! The investigation is over. :) -NT - (a6l6e6x) - (1) - Dec. 29, 2002, 05:41:30 PM EST
             Re: Report: Makka is harmless! The investigation is over. : - (dmarker) - Dec. 29, 2002, 07:33:06 PM EST

How can you die from a fall of a whopping 3 inches?
39 ms