Revival of sunrpc scans?

From: Zen (zen@kill-9.it)
Date: Mon May 07 2001 - 01:19:54 PDT

Next message: Jens Hektor: "Slow DNS scans, backdoor scans, both worming"

Previous message: Frank Quinonez: "Re: 4 similar IIS attempts in a 48 hour period."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I've seen some of these in the last couple of days:

SRC=61.144.231.35 LEN=40 TOS=0x00 PREC=0x00 TTL=232 ID=423 DF PROTO=TCP
SPT=36868 DPT=111 WINDOW=8760 RES=0x00 RST URGP=0
SRC=203.228.23.241 LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=3015 DF PROTO=TCP
SPT=60651 DPT=111 WINDOW=8760 RES=0x00 RST URGP=0
SRC=151.198.245.44 LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=9338 DF PROTO=TCP
SPT=61297 DPT=111 WINDOW=8760 RES=0x00 RST URGP=0
etc...

Maybe the release of a new tool?

bye,
--
'Why do you close your eyes?' 'So that the room will be empty.'
zen@kill-9.it . Geek . And proud of it .
http://www.kill-9.it/jargon/html/entry/zen.html

Next message: Jens Hektor: "Slow DNS scans, backdoor scans, both worming"
Previous message: Frank Quinonez: "Re: 4 similar IIS attempts in a 48 hour period."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri May 11 2001 - 06:43:17 PDT