0

This is small output from tcpdump -i re1 'port 25':

14:00:10.732034 IP cf-190-93-254-113.cloudflare.com.http > MY_IP.smtp: S 4234708404:4234708404(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
14:00:10.747464 IP cf-190-93-252-90.cloudflare.com.http > MY_IP.smtp: S 2396112716:2396112716(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
14:00:10.790744 IP cf-190-93-255-113.cloudflare.com.http > MY_IP.smtp: S 1218828436:1218828436(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
14:00:10.804055 IP cf-190-93-254-113.cloudflare.com.http > MY_IP.smtp: S 1973146744:1973146744(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>

Or this output from tcpdump -n src net 190.93.0.0/16:

13:59:14.388684 IP 190.93.254.113.80 > MY_IP.25: S 2997821316:2997821316(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
13:59:14.394882 IP 190.93.254.113.80 > MY_IP.110: S 3076994870:3076994870(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
13:59:14.407414 IP 190.93.252.90.80 > MY_IP.25: S 943264969:943264969(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
13:59:14.416960 IP 190.93.255.113.80 > MY_IP.110: S 3406738447:3406738447(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
13:59:14.435186 IP 190.93.255.113.80 > MY_IP.25: S 1205583072:1205583072(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>
13:59:14.460652 IP 190.93.254.113.80 > MY_IP.25: S 4135984739:4135984739(0) win 8192 <mss 1412,nop,wscale 8,nop,nop,sackOK>

I'm not a user of cloudflare.com.

I want to know what's going on????

cloudflare.com was hacked or...???

I added this IPs to firewall rules and asked my provader to filter this traffic, but I can't understand...

Improve this question

1 Answer 1

Reset to default
0

There isn't a lot you can say for certain.

Ports 25 and 110 are SMTP and POP3 services respectively.

If you (or a colleague) haven't set up some kind of webmail front-end on a Cloudflare account, I'd guess a Cloudflare customer - or software infiltrated by someone who hacked their account/apps is attempting to break into an Email server at your IP-address.

The source IPs vary, that could just be a feature of Cloudflare's interconnection or it might mean there really are several sources (several distinct Cloudflare customers - perhaps all using Cloudflare provided apps with a common vulnerability).

S means SYN. This is the first part of the three-way handshake that is used to establish a TCP connection. Since your output shows no evidence of continuation it looks like you don't have any service listening on those ports.

To get a better answer you'd have to liaise with Cloudflare support.

Improve this answer
2
  • You don't see any outputs, because I drop all packets from 80 to 25, 110
    – none
    Nov 26, 2014 at 12:41
  • I hadn't noticed the source port being 80. That does seem suggestive of malware. Maybe someone in security.se would recognize the pattern?
    – RedGrittyBrick
    Nov 26, 2014 at 15:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .