RPC scans

From: Jonathan Rickman (jonathanat_private)
Date: Tue Aug 13 2002 - 15:11:10 PDT

  • Next message: Jonathan Rickman: "Re: RPC scans"

    Business is starting to pick up here in my little corner of the net. 111
    has been the favorite target for passing scanners for the last 4 hours now
    and the frequency seems to be increasing. Interestingly enough, most of
    the IP addresses is a dshield repeat offender for RPC scans. Out of 139
    individual hosts, so far all but two have been in China. One was good old
    .kr and another was an Aussie. Am I alone here, or is something
    coordinated/distributed going on?
    Jonathan Rickman
    X Corps Security
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com

    This archive was generated by hypermail 2b30 : Tue Aug 13 2002 - 15:17:30 PDT