================================================================ This example incident report is void - for testing purposes only ================================================================ -------- Original Message -------- Subject: Denial of service attack from Originating_Country [ourcustomer#36891] Date: Fri, 09 Sep 2001 18:28:04 +0100 From: Site Security Contact Organization: Our Customer To: CERT , Responsible One , OriginatingCountrynet Hostmaster , Responsible Three -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 L.S. Today September 9, 2001, at least from 12:31 till 16:10, there has been a denial of service attack to one of our ftp-servers. During certain periods a tcp connect request arrived each 1 or 2 seconds. This attack came from at least two IP-addresses 10.0.0.211 and 10.20.123.132. We have logged other IP-addresses in the neighbourhood of these addresses as well, like 10.20.123.18 and 10.20.123.68 with traffic to this ftp-server. The attached logfile is from the attacked system after denying access for these IP-addresses. The other addressees were found in the APNIC database as the contact persons for the above IP-addresses. For My_Example_CERT, please forward this complaint to the Originating_Country authorities. For the other addressees, please investigate and inform us about the reason for this behaviour. fr.gr. Otto Normahlverbraucher tel. +31-22-2222222 e-mail: SSC@OurCustomer.NL Site Security Officer Our Customer -----BEGIN PGP SIGNATURE----- Version: PGP 7.0 iQA/AwUBOqkEjpoxvmlLq0UAUIDkleookdlliwoslc,iekdTF4AnAym EKiaPFGn79n6XNPds2L007uL =fAnW -----END PGP SIGNATURE-----