Kan nogen hjælpe med at identificere følgende angreb?

Hmmm... er du sikker på at det er den ipaddresse ???
mange firewalls vender rækkefølgen af numrene om i meddelelsen så det muligvis istedet er 224.248.111.33 der scanner din port.

Jeg får den ikke til at være en .mil adresse, men noget internationalt IANA snask fra holland

http://www.ripe.net/perl/whois?form_type=simple&full_query_string=&searchtext=33.111.248.224&do_search=Search

Er det mig der tager helt fejl, hvor har du .mil fra?

Search results for: 224.248.111.33


OrgName:    Internet Assigned Numbers Authority
OrgID:      IANA
Address:    4676 Admiralty Way, Suite 330
City:      Marina del Rey
StateProv:  CA
PostalCode: 90292-6695
Country:    US

NetRange:  224.0.0.0 - 239.255.255.255
CIDR:      224.0.0.0/4
NetName:    MCAST-NET
NetHandle:  NET-224-0-0-0-1
Parent:
NetType:    IANA Special Use
NameServer: FLAG.EP.NET
NameServer: STRUL.STUPI.SE
NameServer: NS.ISI.EDU
NameServer: NIC.NEAR.NET
Comment:    This block is reserved for special purposes.
Comment:    Please see RFC 3171 for additional information.
Comment:
RegDate:    1991-05-22
Updated:    2002-09-16

OrgTechHandle: IANA-ARIN
OrgTechName:  Internet Corporation for Assigned Names and Number
OrgTechPhone:  +1-310-823-9358
OrgTechEmail:  res-ip@iana.org

# ARIN WHOIS database, last updated 2003-08-10 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

bufferzone >> 33.111.248.224 giver ganske rigtigt noget .mil

tonnybrandt: min Firewall vender ikke IP-adressen forkert.

Bufferzone: På dk-hostmaster's søgning, kan du vælge "Extra verbosity" når du søger på en IP... Og så får du:
Query about 224.248.111.33.in-addr.arpa. for record types ANY
Trying 224.248.111.33.in-addr.arpa ...
Query failed, 0 answers, authoritative status: non-existent domain
Authority information:
33.in-addr.arpa        10800    IN    SOA
  AAA-VIENNA.NIPR.MIL HOSTMASTER.NIC.MIL (
  2003080800    ;serial (version)
  10800    ;refresh period (3 hours)
  900    ;retry interval (15 minutes)
  604800    ;expire time (1 week)
  86400    ;default ttl (1 day)
  )
224.248.111.33.in-addr.arpa does not exist (Authoritative answer)

ip 33.111.248.224 ser ut til aa ligge inne bak en firewall. Den siste adresse foer firewall blokkerer ser ut til aa vaere en .mil adresse. Kan tenkes at det dreier seg om en militaer firewall og en ip som routes videre via denne (???)

Search results for: 33.111.248.224


OrgName:    DoD Network Information Center
OrgID:      DNIC
Address:    7990 Science Applications Ct
Address:    M/S CV 50
City:      Vienna
StateProv:  VA
PostalCode: 22183-7000
Country:    US

NetRange:  33.0.0.0 - 33.255.255.255
CIDR:      33.0.0.0/8
NetName:    DCMC-1
NetHandle:  NET-33-0-0-0-1
Parent:
NetType:    Direct Allocation
NameServer: AAA-VIENNA.NIPR.MIL
NameServer: AAA-KELLY.NIPR.MIL
NameServer: AAA-VAIHINGEN.NIPR.MIL
NameServer: AAA-WHEELER.NIPR.MIL
Comment:    DOD Network Information Center
Comment:    7990 Science Applications Court
Comment:    Vienna, VA 22183-7000 US
RegDate:
Updated:    2001-10-12

TechHandle: ZD41-ARIN
TechName:  DOD Network Information Center
TechPhone:  +1-800-365-3642
TechEmail:  HOSTMASTER@nic.mil

OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName:  Network DoD, Network
OrgTechPhone:  +1-703-676-1051
OrgTechEmail:  HOSTMASTER@nic.mil

# ARIN WHOIS database, last updated 2003-08-11 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

tja... det er lidt mystiskt. Men du får pointene for din indsats :c)))

Firewall ser ut til å stå på ip 198.32.136.88

Search results for: 198.32.136.88


OrgName:    Exchange Point Blocks
OrgID:      EPB
Address:    PO 12317
City:      Marina del Rey
StateProv:  CA
PostalCode:
Country:    US

NetRange:  198.32.0.0 - 198.32.255.255
CIDR:      198.32.0.0/16
NetName:    NET-EP-1
NetHandle:  NET-198-32-0-0-1
Parent:    NET-198-0-0-0-0
NetType:    Direct Assignment
NameServer: DOT.EP.NET
NameServer: FLAG.EP.NET
Comment:
RegDate:    1997-06-09
Updated:    2001-12-17

TechHandle: WM110-ARIN
TechName:  Manning, Bill
TechPhone:  +1-310-322-8102
TechEmail:  bmanning@karoshi.com

# ARIN WHOIS database, last updated 2003-08-11 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

Eller på ip 198.26.118.34 (Ennå mere merkelig ..)


Search results for: 196.26.118.34


OrgName:    The Internet Solution
OrgID:      IS
Address:    The Campus, 57 Sloane Street
Address:    Bryanston
City:      Johannesburg
StateProv:  Gauteng
PostalCode: 2021
Country:    ZA

NetRange:  196.26.0.0 - 196.26.255.255
CIDR:      196.26.0.0/16
NetName:    ISNET-03
NetHandle:  NET-196-26-0-0-1
Parent:    NET-196-0-0-0-0
NetType:    Direct Allocation
NameServer: APOLLO.IS.CO.ZA
NameServer: HERMES.IS.CO.ZA
NameServer: NS0.PIPEX.NET
Comment:    ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate:    1995-07-07
Updated:    2000-02-25

TechHandle: ZT12-ARIN
TechName:  The Internet Solution
TechPhone:  +27 11 575 1000
TechEmail:  netadmin@is.co.za

OrgAbuseHandle: ABUSE239-ARIN
OrgAbuseName:  Abuse
OrgAbusePhone:  +27 11 575 0055
OrgAbuseEmail:  abuse@is.co.za

OrgTechHandle: ZT12-ARIN
OrgTechName:  The Internet Solution
OrgTechPhone:  +27 11 575 1000
OrgTechEmail:  netadmin@is.co.za

# ARIN WHOIS database, last updated 2003-08-11 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

Takker for points !!

IP 33.111.248.224 blokkerer alle requester inn hvilket er godt forenelig med at den ligger bak en firewall.