21 July, 2003

Why I Hate Spammers

I finally got around to installing snort this weekend, and it's amazing how much crap gets sent to my computer. So far, I've got a simple setup: snort watches pflog0 and logs/analyses any packets that are blocked by my firewall. In other words, anything that tries to start a connection to my computer.

I'm actually kind of surprised at the sort of hits I'm getting. Most of them are on port 135, which is one of the Windows sharing ports. Lots and lots of attempts to send me annoying pop-up windows advertising....ways to stop the annoying pop-up windows.

Blah. These monkeys really like flinging crap at you. I guess they figure that sooner or later, some of it will hit.

But this is the sort of crap I've been seeing. And lots of it!

07/18-18:02:27.182500 210.5.22.23:29119 -> xxx.xxx.xxx.xxx:135UDP TTL:46 TOS:0x0 ID:0 IpLen:20 DgmLen:460 DFLen: 43204 00 28 00 10 00 00 00 00 00 00 00 00 00 00 00  ..(.............00 00 00 00 00 00 00 00 F8 91 7B 5A 00 FF D0 11  ..........{Z....A9 B2 00 C0 4F B6 E6 FC F4 EE B3 8B 7E 0C 09 50  ....O.......~..PA3 94 ED 38 D3 FC FD 73 00 00 00 00 01 00 00 00  ...8...s........00 00 00 00 00 00 FF FF FF FF 60 01 00 00 00 00  ..........`.....06 00 00 00 00 00 00 00 06 00 00 00 42 4C 4F 43  ............BLOC4B 00 00 00 0A 00 00 00 00 00 00 00 0A 00 00 00  K...............4D 45 53 53 45 4E 47 45 52 00 00 00 28 01 00 00  MESSENGER...(...00 00 00 00 28 01 00 00 42 6C 6F 63 6B 20 74 68  ....(...Block th65 73 65 20 75 6E 77 61 6E 74 65 64 20 70 6F 70  ese unwanted pop75 70 73 20 70 65 72 6D 61 6E 65 6E 74 6C 79 21  ups permanently!20 41 20 4F 4E 45 2D 54 49 4D 45 20 66 65 65 20   A ONE-TIME fee 61 74 0A 68 74 74 70 3A 2F 2F 77 77 77 2E 42 6C  at.http://www.Bl6F 63 6B 4D 65 73 73 65 6E 67 65 72 2E 63 6F 6D  ockMessenger.com0A 0A 44 6F 6E 27 74 20 70 61 79 20 66 6F 72 20  ..Don't pay for 65 78 70 65 6E 73 69 76 65 20 6D 6F 6E 74 68 6C  expensive monthl79 20 73 65 72 76 69 63 65 73 21 0A 0A 44 6F 20  y services!..Do 4E 4F 54 20 63 6C 6F 73 65 20 74 68 69 73 20 77  NOT close this w69 6E 64 6F 77 20 77 69 74 68 6F 75 74 20 76 69  indow without vi73 69 74 69 6E 67 20 68 74 74 70 3A 2F 2F 77 77  siting http://ww77 2E 42 6C 6F 63 6B 4D 65 73 73 65 6E 67 65 72  w.BlockMessenger2E 63 6F 6D 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  .com............0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ................0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ................0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ................0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A  ................0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 0A 00  ................

No comments:

Post a Comment