Another of those strange IP ranges.

[GuRu]

Anyone had these IP ranges ?

Wed Jul 27 15:50:47 2005 Dos Attack type : Spoofing!!
Wed Jul 27 15:50:47 2005 Dos Attack type : Spoofing!!
Wed Jul 27 15:50:48 2005 Dos Attack type : Spoofing!!
Wed Jul 27 15:50:48 2005 Dos Attack type : Spoofing!!
Wed Jul 27 15:51:29 2005 Unrecognized attempt blocked from 194.106.211.xxx :xxxx to 196.2.11x.xxx TCP:xxxx
Wed Jul 27 15:51:29 2005 Unrecognized attempt blocked from 194.106.211.216:xxxx to 196.2.11x.xxx UDP:xxxx
Wed Jul 27 15:51:31 2005 Unrecognized attempt blocked from 194.106.211.xxx:xxxx to 196.2.11x8.xxx TCP:xxxx
Wed Jul 27 15:51:38 2005 Unrecognized attempt blocked from 194.106.211.xxx:xxxx to 196.2.11x.xxx TCP:xxxx
Wed Jul 27 15:51:57 2005 Unrecognized attempt blocked from 196.2.118.xxxx:xxxx to 196.2.11x.xxx TCP:xxx
Wed Jul 27 15:51:58 2005 Unrecognized attempt blocked from 196.2.118.xxx:xxxx to 196.2.11x.xxx TCP:xxx
--- Log End ---

 

[Jongi]

This might be the same thing:

http://mybroadband.co.za/vb/showthread.php?goto=newpost&t=24288

 

[GuRu]

no these go from 194.xxx.xxx.x to 196.xxx.xx.x

 

[JasonH]

All of my "Unrecognized attempt blocked" were from 196.2.xxx.xxx

 

[RichardG]

Count:1
Action:Monitored
Application:System
Accessort scan detected
Object:196.7.147.165
Interface:
Time:2005/07/27 06:20:14 PM

Count:1
Action:Monitored
Application:System
Accessort scan detected
Object:196.2.127.9
Interface:
Time:2005/07/27 06:20:43 PM

Count:1
Action:Monitored
Application:System
Accessort scan detected
Object:194.109.21.230
Interface:
Time:2005/07/27 06:14:41 PM


loads of those

 

[GuRu]

Did a whois

Search results for: 194.106.211.216


OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: 194.0.0.0 - 194.255.255.255
CIDR: 194.0.0.0/8
NetName: RIPE-CBLK2
NetHandle: NET-194-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: NS2.NIC.FR
NameServer: SUNIC.SUNET.SE
NameServer: AUTH03.NS.UU.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate: 1993-07-21
Updated: 2004-03-16

# ARIN WHOIS database, last updated 2005-07-26 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.



*** Anyone ?????***

 

[Jongi]

What does it all mean?

 

[TheRoDent]

It means you are on the internet.

These kind of portscans/attacks are quite common. I do about 40-50Mb on an average month in portscans.

 

[bin3]

I do about 40-50Mb on an average month in portscans.

You do or you get ? ;-)

 

[RichardG]

Port scans !!!!
From WBS aint normal there CATCHE server from JHB, or is it normal