RE: TCP 1025 scanning worm?

From: Rob Keown (Keownat_private)
Date: Wed Jul 17 2002 - 14:38:48 PDT

Next message: Alfred Huger: "Announcement"

Previous message: Alfred Huger: "Announcement"
Maybe in reply to: Richard Johnson: "TCP 1025 scanning worm?"
Next in thread: H C: "re: TCP 1025 scanning worm?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Looking at Dshield http://www.dshield.org/port_report.php for port 1025 I
don't see too much activity at all.

-----Original Message-----
From: Richard Johnson [mailto:rdumpat_private]
Sent: Wednesday, July 17, 2002 3:38 PM
To: incidentsat_private
Subject: TCP 1025 scanning worm?

Starting at 11:38:12 UTC on July 17, we started seeing full-network port
scans looking for TCP port 1025.

The sources are all Windows boxes listening on TCP port 1025.  The ramp up
in volume from widely separated source IPs looks wormy.

Is this a targeted attack against my nets, or are others seeing this
scanning too?

Richard

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Alfred Huger: "Announcement"
Previous message: Alfred Huger: "Announcement"
Maybe in reply to: Richard Johnson: "TCP 1025 scanning worm?"
Next in thread: H C: "re: TCP 1025 scanning worm?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Jul 17 2002 - 15:24:33 PDT