IPTables Drop Log For 05.12.09

Posted 1104 days ago - Security

The Internet; so magical and dangerous, getting connected is a risk we're all willing to take. Whether you're infiltrating some moron's botnet, or just surfing the web, the possibility of becoming a victim in a cyber attack is real. Everyday, without fail, Nullamatix.com is bombarded with malicious attacks from all over the world. Typically, the attackers aren't targeting Nullamatix.com specifically, but a wide range of hosts, including you.

Here's a log snippet from yesterdays events:

SRC=77.106.194.150   DST=209.40.196.119	SPT=1209    DPT=31577
SRC=67.223.213.174   DST=209.40.196.119	SPT=3195    DPT=135
SRC=79.125.10.202    DST=209.40.196.119	SPT=22      DPT=3072
SRC=66.209.106.210   DST=209.40.196.119	SPT=31748   DPT=1433
SRC=66.209.106.210   DST=209.40.196.119	SPT=31748   DPT=1433
SRC=67.223.213.174   DST=209.40.196.119	SPT=1227    DPT=135
SRC=208.77.45.66     DST=209.40.196.119	SPT=12200   DPT=1080
SRC=208.77.45.66     DST=209.40.196.119	SPT=12200   DPT=3128
SRC=208.77.45.66     DST=209.40.196.119	SPT=12200   DPT=8080
SRC=208.77.45.66     DST=209.40.196.119	SPT=12200   DPT=3128
SRC=208.77.45.66     DST=209.40.196.119	SPT=12200   DPT=6588
SRC=67.223.145.49    DST=209.40.196.119	SPT=47606   DPT=135
SRC=76.73.92.11      DST=209.40.196.119	SPT=80      DPT=24174
SRC=76.73.92.11      DST=209.40.196.119	SPT=80      DPT=24174
SRC=76.73.92.11      DST=209.40.196.119	SPT=80      DPT=24174
SRC=76.73.92.11      DST=209.40.196.119	SPT=80      DPT=24174
SRC=67.223.213.174   DST=209.40.196.119	SPT=1404    DPT=135
SRC=125.71.214.71    DST=209.40.196.119	SPT=20494   DPT=38926
SRC=125.71.214.71    DST=209.40.196.119	SPT=20494   DPT=38926
SRC=221.235.54.50    DST=209.40.196.119	SPT=5404    DPT=51981
SRC=221.235.54.50    DST=209.40.196.119	SPT=5404    DPT=51981
SRC=67.223.145.49    DST=209.40.196.119	SPT=9773    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=4924    DPT=135
SRC=118.123.5.96     DST=209.40.196.119	SPT=6000    DPT=135
SRC=118.123.5.96     DST=209.40.196.119	SPT=6000    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=3572    DPT=135
SRC=67.223.145.49    DST=209.40.196.119	SPT=51347   DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=2078    DPT=135
SRC=208.109.67.68    DST=209.40.196.119	SPT=80      DPT=24174
SRC=208.109.67.68    DST=209.40.196.119	SPT=80      DPT=24174
SRC=67.223.213.174   DST=209.40.196.119	SPT=3329    DPT=135
SRC=208.109.67.68    DST=209.40.196.119	SPT=80      DPT=24174
SRC=67.223.213.174   DST=209.40.196.119	SPT=1787    DPT=135
SRC=91.98.66.195     DST=209.40.196.119	SPT=51704   DPT=22
SRC=221.209.110.113  DST=209.40.196.119	SPT=48829   DPT=1027
SRC=67.223.213.174   DST=209.40.196.119	SPT=2412    DPT=135
SRC=67.159.61.64     DST=209.40.196.119	SPT=1351    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=3931    DPT=135
SRC=67.159.61.64     DST=209.40.196.119	SPT=2149    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=4331    DPT=135
SRC=61.191.63.8      DST=209.40.196.119	SPT=6000    DPT=2967
SRC=67.223.213.174   DST=209.40.196.119	SPT=1324    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=4836    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=1151    DPT=135
SRC=114.59.42.69     DST=209.40.196.119	SPT=2186    DPT=56561
SRC=114.59.42.69     DST=209.40.196.119	SPT=2186    DPT=56561
SRC=118.123.5.109    DST=209.40.196.119	SPT=6000    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=3101    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=2694    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=4393    DPT=135
SRC=123.233.245.226  DST=209.40.196.119	SPT=20619   DPT=22
SRC=67.223.213.174   DST=209.40.196.119	SPT=3753    DPT=135
SRC=218.22.244.45    DST=209.40.196.119	SPT=1361    DPT=1434
SRC=67.223.213.174   DST=209.40.196.119	SPT=3392    DPT=135
SRC=118.123.5.109    DST=209.40.196.119	SPT=6000    DPT=135
SRC=173.45.90.10     DST=209.40.196.119	SPT=54835   DPT=10000
SRC=67.223.213.174   DST=209.40.196.119	SPT=4947    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=4947    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=3629    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=4875    DPT=135
SRC=67.223.213.174   DST=209.40.196.119	SPT=4875    DPT=135
SRC=58.218.206.9     DST=209.40.196.119	SPT=6000    DPT=3389
SRC=67.223.213.174   DST=209.40.196.119	SPT=4196    DPT=135
SRC=67.223.212.164   DST=209.40.196.119	SPT=42375   DPT=135
SRC=67.223.212.164   DST=209.40.196.119	SPT=42375   DPT=135
SRC=67.220.210.18    DST=209.40.196.119	SPT=4890    DPT=135
SRC=67.205.99.205    DST=209.40.196.119	SPT=58616   DPT=135
SRC=61.150.91.36     DST=209.40.196.119	SPT=80      DPT=24174
SRC=116.58.36.139    DST=209.40.196.119	SPT=1087    DPT=31577
SRC=222.252.155.199  DST=209.40.196.119	SPT=11329   DPT=63657
SRC=194.44.165.81    DST=209.40.196.119	SPT=1363    DPT=63280
SRC=77.43.166.191    DST=209.40.196.119	SPT=3868    DPT=139
SRC=77.43.166.191    DST=209.40.196.119	SPT=3868    DPT=139
SRC=61.147.112.19    DST=209.40.196.119	SPT=6000    DPT=1433
SRC=61.147.112.19    DST=209.40.196.119	SPT=6000    DPT=1433
SRC=218.237.108.228  DST=209.40.196.119	SPT=1425    DPT=58281
SRC=118.123.5.105    DST=209.40.196.119	SPT=6000    DPT=135
SRC=195.78.247.4     DST=209.40.196.119	SPT=2203    DPT=31577
SRC=221.204.214.50   DST=209.40.196.119	SPT=35684   DPT=56561
SRC=221.204.214.50   DST=209.40.196.119	SPT=35684   DPT=56561
SRC=62.120.26.213    DST=209.40.196.119	SPT=1217    DPT=63657
SRC=89.149.236.221   DST=209.40.196.119	SPT=80      DPT=20335
SRC=209.42.180.144   DST=209.40.196.119	SPT=1789    DPT=135
SRC=95.133.46.106    DST=209.40.196.119	SPT=1034    DPT=63657
SRC=221.195.73.68    DST=209.40.196.119	SPT=6000    DPT=7212
SRC=221.195.73.68    DST=209.40.196.119	SPT=6000    DPT=8000
SRC=121.230.53.207   DST=209.40.196.119	SPT=1475    DPT=58281
SRC=221.209.110.113  DST=209.40.196.119	SPT=52525   DPT=1027
SRC=95.211.14.208    DST=209.40.196.119	SPT=80      DPT=3072
SRC=95.211.14.208    DST=209.40.196.119	SPT=80      DPT=3072
SRC=93.90.224.237    DST=209.40.196.119	SPT=1070    DPT=65035
SRC=67.55.227.247    DST=209.40.196.119	SPT=3495    DPT=135
SRC=67.55.227.247    DST=209.40.196.119	SPT=3495    DPT=135
SRC=118.123.5.109    DST=209.40.196.119	SPT=6000    DPT=135
SRC=118.123.5.109    DST=209.40.196.119	SPT=6000    DPT=135
SRC=206.156.254.185  DST=209.40.196.119	SPT=50696   DPT=22
SRC=206.156.254.185  DST=209.40.196.119	SPT=50696   DPT=22
SRC=220.162.241.11   DST=209.40.196.119	SPT=6649    DPT=1433
SRC=221.195.40.169   DST=209.40.196.119	SPT=6000    DPT=3128
SRC=94.179.49.141    DST=209.40.196.119	SPT=2501    DPT=56561
SRC=94.179.49.141    DST=209.40.196.119	SPT=2501    DPT=56561
SRC=41.211.213.59    DST=209.40.196.119	SPT=1116    DPT=58281
SRC=220.162.241.11   DST=209.40.196.119	SPT=43608   DPT=1433
SRC=220.162.241.11   DST=209.40.196.119	SPT=51053   DPT=1433
SRC=122.117.60.80    DST=209.40.196.119	SPT=60798   DPT=25
SRC=122.117.60.80    DST=209.40.196.119	SPT=60798   DPT=25
SRC=218.4.149.124    DST=209.40.196.119	SPT=2603    DPT=1434
SRC=118.123.5.109    DST=209.40.196.119	SPT=6000    DPT=135
SRC=118.123.5.109    DST=209.40.196.119	SPT=6000    DPT=135
SRC=81.19.132.8      DST=209.40.196.119	SPT=1907    DPT=31577
SRC=63.223.110.213   DST=209.40.196.119	SPT=60780   DPT=22
SRC=63.223.110.213   DST=209.40.196.119	SPT=60780   DPT=22
SRC=221.209.110.107  DST=209.40.196.119	SPT=49670   DPT=1026
SRC=221.235.54.50    DST=209.40.196.119	SPT=5404    DPT=51981
SRC=221.235.54.50    DST=209.40.196.119	SPT=5404    DPT=51981
SRC=94.50.116.235    DST=209.40.196.119	SPT=1553    DPT=63657
SRC=193.252.218.143  DST=209.40.196.119	SPT=1211    DPT=10000
SRC=218.6.12.230     DST=209.40.196.119	SPT=6000    DPT=1433
SRC=221.209.110.113  DST=209.40.196.119	SPT=32996   DPT=1026
SRC=209.252.84.131   DST=209.40.196.119	SPT=4851    DPT=139
SRC=125.65.112.217   DST=209.40.196.119	SPT=12200   DPT=1080
SRC=125.65.112.217   DST=209.40.196.119	SPT=12200   DPT=8080
SRC=168.126.20.129   DST=209.40.196.119	SPT=6000    DPT=1433
SRC=67.223.145.49    DST=209.40.196.119	SPT=33369   DPT=135
SRC=211.147.220.190  DST=209.40.196.119	SPT=6000    DPT=2967
SRC=189.89.38.204    DST=209.40.196.119	SPT=40910   DPT=22
SRC=189.89.38.204    DST=209.40.196.119	SPT=40910   DPT=22
SRC=61.160.213.53    DST=209.40.196.119	SPT=6000    DPT=135
SRC=67.223.145.49    DST=209.40.196.119	SPT=4459    DPT=135
SRC=211.157.103.138  DST=209.40.196.119	SPT=80      DPT=8137
SRC=218.4.149.124    DST=209.40.196.119	SPT=2603    DPT=1434
SRC=221.209.110.105  DST=209.40.196.119	SPT=40933   DPT=1027
SRC=67.36.63.137     DST=209.40.196.119	SPT=3522    DPT=135
SRC=67.223.145.49    DST=209.40.196.119	SPT=62708   DPT=135
SRC=61.191.63.3      DST=209.40.196.119	SPT=6000    DPT=135
SRC=61.191.63.3      DST=209.40.196.119	SPT=6000    DPT=135
SRC=67.223.145.49    DST=209.40.196.119	SPT=10600   DPT=135
SRC=65.98.240.53     DST=209.40.196.119	SPT=6000    DPT=3389
SRC=190.50.208.179   DST=209.40.196.119	SPT=24647   DPT=63280
SRC=67.223.145.49    DST=209.40.196.119	SPT=51588   DPT=135
SRC=201.134.103.165  DST=209.40.196.119	SPT=2481    DPT=22
SRC=201.134.103.165  DST=209.40.196.119	SPT=2481    DPT=22
SRC=221.209.110.105  DST=209.40.196.119	SPT=46610   DPT=1026
SRC=67.223.145.49    DST=209.40.196.119	SPT=47459   DPT=135
SRC=61.160.211.21    DST=209.40.196.119	SPT=6000    DPT=2967
SRC=67.223.145.49    DST=209.40.196.119	SPT=16728   DPT=135
SRC=221.130.198.14   DST=209.40.196.119	SPT=6000    DPT=8080
SRC=221.130.198.14   DST=209.40.196.119	SPT=6000    DPT=8080
SRC=201.78.227.103   DST=209.40.196.119	SPT=1578    DPT=36858
SRC=201.78.227.103   DST=209.40.196.119	SPT=1578    DPT=36858
SRC=58.53.192.47     DST=209.40.196.119	SPT=53802   DPT=22
SRC=67.18.130.34     DST=209.40.196.119	SPT=1475    DPT=4899
SRC=190.146.236.242  DST=209.40.196.119	SPT=63498   DPT=58281
SRC=202.101.42.73    DST=209.40.196.119	SPT=4310    DPT=5900
SRC=202.101.42.73    DST=209.40.196.119	SPT=4310    DPT=5900
SRC=190.144.121.90   DST=209.40.196.119	SPT=9366    DPT=22
SRC=190.144.121.90   DST=209.40.196.119	SPT=9366    DPT=22
SRC=190.41.24.150    DST=209.40.196.119	SPT=11901   DPT=48222
SRC=190.41.24.150    DST=209.40.196.119	SPT=11901   DPT=48222
SRC=221.195.40.169   DST=209.40.196.119	SPT=6000    DPT=2967
SRC=61.160.211.21    DST=209.40.196.119	SPT=6000    DPT=2967
SRC=219.85.29.130    DST=209.40.196.119	SPT=4460    DPT=25
SRC=219.85.29.130    DST=209.40.196.119	SPT=4460    DPT=25
SRC=211.157.103.138  DST=209.40.196.119	SPT=80      DPT=8137
SRC=89.36.82.43      DST=209.40.196.119	SPT=80      DPT=1024
SRC=58.30.19.33      DST=209.40.196.119	SPT=80      DPT=8137
SRC=60.28.166.94     DST=209.40.196.119	SPT=80      DPT=8137
SRC=81.183.213.107   DST=209.40.196.119	SPT=35216   DPT=4899
SRC=81.183.213.107   DST=209.40.196.119	SPT=35216   DPT=4899
SRC=81.183.213.107   DST=209.40.196.119	SPT=35216   DPT=4899
SRC=211.157.103.138  DST=209.40.196.119	SPT=80      DPT=8137
SRC=60.28.166.94     DST=209.40.196.119	SPT=80      DPT=8137
SRC=221.195.73.68    DST=209.40.196.119	SPT=6000    DPT=7212
SRC=221.195.73.68    DST=209.40.196.119	SPT=6000    DPT=8000
SRC=61.147.112.81    DST=209.40.196.119	SPT=6000    DPT=1433
SRC=61.147.112.81    DST=209.40.196.119	SPT=6000    DPT=1433
SRC=58.20.154.23     DST=209.40.196.119	SPT=1857    DPT=1434
SRC=201.21.82.66     DST=209.40.196.119	SPT=1211    DPT=58281
SRC=67.223.212.164   DST=209.40.196.119	SPT=58648   DPT=135
SRC=67.223.212.164   DST=209.40.196.119	SPT=58648   DPT=135
SRC=61.137.90.253    DST=209.40.196.119	SPT=6000    DPT=8080
SRC=98.212.142.147   DST=209.40.196.119	SPT=2370    DPT=1433
SRC=221.209.110.105  DST=209.40.196.119	SPT=33472   DPT=1026
SRC=125.65.112.177   DST=209.40.196.119	SPT=6000    DPT=135
SRC=118.123.5.105    DST=209.40.196.119	SPT=6000    DPT=135
SRC=61.160.216.63    DST=209.40.196.119	SPT=12200   DPT=7212
SRC=61.160.216.63    DST=209.40.196.119	SPT=12200   DPT=8000
SRC=118.123.5.105    DST=209.40.196.119	SPT=6000    DPT=135
SRC=67.220.210.18    DST=209.40.196.119	SPT=4768    DPT=135
SRC=125.65.165.139   DST=209.40.196.119	SPT=12200   DPT=3128
SRC=125.65.165.139   DST=209.40.196.119	SPT=12200   DPT=8000
SRC=220.190.66.78    DST=209.40.196.119	SPT=65370   DPT=63280
SRC=209.252.84.131   DST=209.40.196.119	SPT=2789    DPT=139
SRC=209.252.84.131   DST=209.40.196.119	SPT=2789    DPT=139
SRC=58.20.154.23     DST=209.40.196.119	SPT=1857    DPT=1434
SRC=67.223.133.85    DST=209.40.196.119	SPT=47303   DPT=135
SRC=187.141.71.172   DST=209.40.196.119	SPT=44820   DPT=22
SRC=67.223.133.85    DST=209.40.196.119	SPT=12397   DPT=135
SRC=189.228.129.174  DST=209.40.196.119	SPT=60701   DPT=22
SRC=58.83.127.206    DST=209.40.196.119	SPT=55453   DPT=36858
SRC=58.83.127.206    DST=209.40.196.119	SPT=55453   DPT=36858
SRC=67.223.133.85    DST=209.40.196.119	SPT=32873   DPT=135
SRC=221.209.110.105  DST=209.40.196.119	SPT=44753   DPT=1026
SRC=67.213.14.126    DST=209.40.196.119	SPT=4163    DPT=135

The point of this post is to stress the importance of keeping your networks secure. Whether you're responsible for 1 IP address, or 65,000, there's no room for error. Take the time to setup a firewall if you haven't already. And never trust outgoing connections, despite the temptation to just say, "Fuck it, this is too much work." Always monitor traffic coming in or going out of your network, keep a watchful eye on logs (they won't watch themselves...), and never, EVER permit inbound traffic from untrusted sources on server management ports (22, 3389, 3306, etc).

If you can't afford to implement these simple security measures now, how can you afford to have your identify stolen or defend yourself in court for distributing child pornography later? Do you think you're invisible to such disastrous events? Share your comments or questions below...

Word Count: 1048

Tags: , , , , ,

Click Here to Submit a Comment

Permalink / Last Modified:

Support Nullamatix.com:

See Also:

  • 12/28/2009 -- Invalid Packets From the DoD
    Excerpt: "The firewall policies on Nullamatix.com DROP invalid connection attempts. Specifically, if an attempt to start a new tcp connection is not a syn packet, the packet is rejected. This morning I noticed a few dropped connection attempts from an unusual source, ..."
  • 01/17/2010 -- New Tool: IP Range to CIDR
    Excerpt: "At least twice a week I find myself visiting ip2cidr.com, the IP to CIDR converter. Since the owner/author of the site hasn't release the source code, and I love a challenge, I developed my own version. The guys at the job find the tool useful, and after a ..."
  • 08/14/2009 -- Howto: Tail Lighttpd Logs with Style using Sed
    Excerpt: "Although extremely useful, http server access logs are a mess in their raw form. If you're interested in watching your http server logs in real time with formatting rules and pretty colors, this post is for you. Teh Scr1pt Create a new file to put the l33t ..."
  • 04/24/2009 -- New Page: Interesting Server Logs
    Excerpt: "This is a short post. A status update more than anything. Before posting Madlib Site PHP code examples demonstrating how to use the content you've obtained from: Free Data Sources for Blue Hat SEO's Madlib Technique, I thought of a potentially interesting ..."

Leave a Reply