Newsgroup: it.news.net-abuse
Titolo: di certo OT, ma avrei bisogno di aiuto

questa mattina ho ricevuto circa 4000 allarmi sul firewall
questa č una porzione del log:
GMT,
195.110.96.175:80
,
151.25.49.199:8022
,TCP (flags:AP)
FWIN,2001/12/21,08:29:37 +1:00 GMT,
195.110.96.179:80
,
151.25.49.199:23671
,TCP
(flags:AP)
FWIN,2001/12/21,08:29:45 +1:00 GMT,
195.110.96.140:80
,
151.25.49.199:12551
,TCP
(flags:AP)
FWIN,2001/12/21,08:29:46 +1:00 GMT,
195.110.96.179:80
,
151.25.49.199:14385
,TCP
(flags:AP)
FWIN,2001/12/21,08:29:48 +1:00 GMT,
195.110.96.186:80
,
151.25.49.199:21415
,TCP
(flags:AP)
FWIN,2001/12/21,08:29:51 +1:00 GMT,
195.110.96.145:80
,
151.25.49.199:6113
,TCP
(flags:AP)
FWIN,2001/12/21,08:29:52 +1:00 GMT,
195.110.96.131:80
,
151.25.49.199:25586
,TCP
(flags:APF)
FWIN,2001/12/21,08:29:53 +1:00 GMT,
195.110.96.132:80
,
151.25.49.199:19144
,TCP
(flags:APF)
FWIN,2001/12/21,08:29:54 +1:00 GMT,
195.110.96.192:80
,
151.25.49.199:17874
,TCP
(flags:AP)
FWIN,2001/12/21,08:29:54 +1:00 GMT,
195.110.96.147:80
,
151.25.49.199:7588
,TCP
(flags:AP)
FWIN,2001/12/21,08:29:56 +1:00 GMT,
195.110.96.167:80
,
151.25.49.199:22892
,TCP
(flags:AP)
FWIN,2001/12/21,08:29:58 +1:00 GMT,
195.110.96.161:80
,
151.25.49.199:5578
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:00 +1:00 GMT,
195.110.96.170:80
,
151.25.49.199:10488
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:00 +1:00 GMT,
195.110.96.146:80
,
151.25.49.199:9283
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:01 +1:00 GMT,
195.110.96.173:80
,
151.25.49.199:5799
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:07 +1:00 GMT,
195.110.96.184:80
,
151.25.49.199:8207
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:11 +1:00 GMT,
195.110.96.188:80
,
151.25.49.199:9547
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:11 +1:00 GMT,
195.110.96.145:80
,
151.25.49.199:17144
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:12 +1:00 GMT,
195.110.96.125:80
,
151.25.49.199:5718
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:12 +1:00 GMT,
195.110.96.180:80
,
151.25.49.199:5902
,TCP
(flags:APF)
PE,2001/12/21,08:30:15 +1:00 GMT,Windows Explorer,
127.0.0.1:2273
,N/A
FWIN,2001/12/21,08:30:15 +1:00 GMT,
195.110.96.136:80
,
151.25.49.199:24249
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:17 +1:00 GMT,
195.110.96.196:80
,
151.25.49.199:6726
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:17 +1:00 GMT,
195.110.96.131:80
,
151.25.49.199:19098
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:21 +1:00 GMT,
195.110.96.160:80
,
151.25.49.199:22236
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:22 +1:00 GMT,
195.110.96.131:80
,
151.25.49.199:10245
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:27 +1:00 GMT,
195.110.96.196:80
,
151.25.49.199:4773
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:28 +1:00 GMT,
195.110.96.188:80
,
151.25.49.199:19196
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:29 +1:00 GMT,
195.110.96.160:80
,
151.25.49.199:5982
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:37 +1:00 GMT,
195.110.96.153:80
,
151.25.49.199:24247
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:37 +1:00 GMT,
195.110.96.168:80
,
151.25.49.199:13850
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:37 +1:00 GMT,
195.110.96.167:80
,
151.25.49.199:21868
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:41 +1:00 GMT,
195.110.96.177:80
,
151.25.49.199:9292
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:43 +1:00 GMT,
195.110.96.137:80
,
151.25.49.199:21502
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:44 +1:00 GMT,
195.110.96.146:80
,
151.25.49.199:20096
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:45 +1:00 GMT,
195.110.96.140:80
,
151.25.49.199:17147
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:45 +1:00 GMT,
195.110.96.192:80
,
151.25.49.199:11821
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:45 +1:00 GMT,
195.110.96.168:80
,
151.25.49.199:10138
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:48 +1:00 GMT,
195.110.96.146:80
,
151.25.49.199:6108
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:48 +1:00 GMT,
195.110.96.125:80
,
151.25.49.199:19610
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:48 +1:00 GMT,
195.110.96.177:80
,
151.25.49.199:13133
,TCP
(flags:APF)
FWIN,2001/12/21,08:30:49 +1:00 GMT,
195.110.96.149:80
,
151.25.49.199:20639
,TCP
(flags:AP)
FWIN,2001/12/21,08:30:50 +1:00 GMT,
195.110.96.163:80
,
151.25.49.199:24619
,TCP
(flags:AP)
ne desumo che la persona in questione usasse qualche backdoor di supereva
per potermi "attaccare" usando tutti quegli ip, risolvendoli si ha:
195.110.96.107 ---> 
adamo.supereva.it
|                         ---> 
adamo1.supereva.it
|                         ---> 
adamo2.supereva.it
|                         ---> ecc...
195.110.96.213 ---> 
adamo99.supereva.it
qual'č il comando da shell dos che mi permette di avere informazioni su un
provider
vorrei mandare una mail a all'admin di supereva
voi cosa ne pensate?
--
Grazie x l'attenzione
Ciao, Dragster

 porzione del log:
Sei OT e dovresti prenderti la briga di capire
il significato di "port" e "flag", prima di postare
n-mila righe di log.