At 01:52 AM 4/25/01, Jeff Nieusma wrote: >anyone else getting TCP scans directed at port >1008? My solaris system says: > >- solaris7$ grep 1008 /etc/services >ufsd 1008/tcp ufsd # UFS-aware >server >ufsd 1008/udp ufsd > >I've seen 215 log entries this month from 9 Internet >hosts aimed at 177 internal hosts behind a filter that >denies port 1008. Anyone know anything about this? I've seen them every day from the past two weeks from 209.112.47.7 (Canada). But the scans I see also include port 1524, which is a well known backdoor port. Port 1008 is a backdoor for some exploit, the name of which escapes me right now. Daily emails to the point of contact and the abuse address go unanswered. -- Joe
This archive was generated by hypermail 2b30 : Thu Apr 26 2001 - 08:26:24 PDT