Security Incidents: Re: Port 111 Scans (odd single IP# probes too)

[Rob Kouwenberg <rob () KOUWENBERG COM>]

> Hi,
>
>
> Here is a list of the IP's that have done repeated (ie more than 1)
> rpc scans on our networks:
> Abuse / Tech contacts have been informed. Quite a few from the .kr
> region with no response / usual response.
In comp.security.unix these .kr blocks were mentioned :

202.6.95.0/24
202.14.103.0/24
202.14.165.0/24
202.20.82.0/24
202.20.84.0/24
202.20.86.0/24
202.20.99.0/24
202.20.119.0/24
202.20.128.0/17
202.20.0.0/21
202.30.0.0/15
203.224.0.0/11
210.90.0.0/15
210.92.0.0/14
210.96.0.0/11
210.178.0.0/15
210.180.0.0/14
210.204.0.0/14
210.216.0.0/13
211.32.0.0/11
211.104.0.0/13
211.112.0.0/13
211.168.0.0/13
211.176.0.0/12
211.192.0.0/12

Use it to your own advantage ...