Some Logs and/or packets please?

Published: 2015-01-09
Last Updated: 2015-01-10 03:15:45 UTC
by Mark Hofman (Version: 1)
8 comment(s)

Hi,   if you have some logs from the following subnets to your infrastructure and you are able to share, could you?

  • (although I'll take /16)

If you can't share logs or packets,  maybe you could send me a source IP and Destination Port.  (just use the contact form or send them direct to markh.isc (at)  )

The above are all active on SSH and DNS, just trying to see if there is anything else and if so what and in which part of the world.  



NOTE:  Thanks for all the info so far, very much appreciated,  keep it coming.  If sending a file please email direct to markh.isc (at) as the contact form file facility is having a challenge.  It is being looked at, but in the mean time please use the email address.  - RESOLVED

Update:  Firstly thank you all for providing information.  The response has been great.  I've spent the last 5 hours sending thank you's and getting the info down :-).  

A first look at the data is already providing some interesting info.  I'll hopefully get the first cut of some info out later today.  If you have devices in the Middle East, Africa, Asia, Europe, South America or Australia I especially interested in those.  Also if you have a packet capture for allowed connections from, 65, 66, 67  or IDS/IPS capture of the initial request (allowed or denied) and you can share, great.  

Some of the log shared so far include firewall and router logs, honeypot logs (one especially interesting as it is using P0F to passively finger print the source), but also some really interesting netflow and argus info.  So again thanks to you all. 

Thanks M

8 comment(s)


Sent you an email full of packets, psad and fail2ban logs a few minutes ago.
Seeing ICMP, SSH, DNS, x11, Zeus? (probably, looking for port 9090), NTP, VNC
I don't have pcaps to send but I'm also seeing a moderate amount of activity on my perimeter from Most of the logs are blocked attempts to various IPs on my perimeter to TCP/22.
Whenever I see posts like this I want to know more about that block of IP addresses. For example I know I can go to and search and More interesting to me are the results of a blacklist check.

If I type in it will report blacklist status from 70+ different sources. Does anyone know how to get information like this for multiple IP addresses? For example.

Type in

X number of IP address in this block are blacklisted.
Statistics from Poland

>grep "218.2.0" kippo.log* | wc -l
>grep "122.225" kippo.log* | wc -l
>grep "61.174.51" kippo.log* | wc -l
>grep "112.101.64" kippo.log* | wc -l
>grep "103.41.124" kippo.log* | wc -l
>grep "61.240.144" kippo.log* | wc -l
>ls -l kippo.log* | wc -l
>ls -lt | tail -1 | cut -d" " -f 6-
Jun 15 2014 kippo.log.690

Cheers sweep scan TCP 22 sweep scan TCP 22 sweep scan TCP 22 sweep scan TCP 22 sweep scan TCP 22 sweep scan TCP 22 sweep scan TCP 22 sweep scan TCP 22 sweep scan TCP 22 - sweep scan TCP 22 - sweep scan TCP 23, 25, 111, 443, 636, 777, 1158, 3128, 3389, 5900, 8009, 9312, 60010 - sweep scan TCP 22, 1433, 3306, 6379, 7001, 8080, 8090, 8360, 9312, 11211, 27017, 50030, 50070, 60030 - sweep scan UDP 53 - sweep scan TCP 21, 81, 88, 110, 111, 873, 1158, 4899, 5800, 8088, 32764, 50010, 50030, 60010, 60030 - sweep scan UDP 23
most of these ranges are currently or in the last week active on my honeypots in europe...
-> you can get a daily db-dump there too....

I know this is an old thread but was wondering if you could share info on what you discovered.
I found that my company is getting scanned every day by address in this block:
I have packet captures and firewall logs from some of the scans. It looks like a SYN scan, but it attempts to go to the same ports each day. They are scanning every external IP address at multiple sites around the world.

Diary Archives