My complete logs are not available to me at the moment as I'm on the road,
but I too have seen a steady increase of RPC scans over the past 10-14
days. There have been some whisperings on the newsgroups of a possible
new worm - has anyone heard anything along those lines?

--Tim

160.78.31.151
211.43.11.3
4.34.155.70
4.19.91.5
211.46.236.177

Jason Lewis <jlewisJASONLEWIS.NET>
Sent by: Incidents Mailing List <INCIDENTSSECURITYFOCUS.COM>
01/15/2001 01:20
Please respond to jlewis

        To: INCIDENTSSECURITYFOCUS.COM
        cc:
        Subject: Re: anyone else seen an increase in sunrpc scans these days?

I couldn't find any of those addresses, but I have similar scans in my
logs.

63.91.6.36
64.32.209.213
64.21.114.2
66.22.62.2
216.98.160.251

Last 24 hours....all the above IP's are looking for Sun RPC.

jas
http://www.rivalpath.com

-----Original Message-----
From: Incidents Mailing List [mailto:INCIDENTSSECURITYFOCUS.COM]On
Behalf Of Alex Popa
Sent: Sunday, January 14, 2001 7:26 PM
To: INCIDENTSSECURITYFOCUS.COM
Subject: anyone else seen an increase in sunrpc scans these days?

In the last five days, the port scans to my entire class C have
dramatically
increased, from one per two days on average, to four yesterday and six
today.

Is there a new exploit around, or is there some sort of new worm out
there?

I might just be paranoid, but here are the addreses that have been looking
for port 111 in the last 26 hours:

24.26.121.156
24.168.66.119
64.31.226.156
142.169.227.102
193.226.15.15
211.218.144.11

------------+------------------------------------------
Alex Popa, | "Artificial Intelligence is
razorldc.ro| no match for Natural Stupidity"
------------+------------------------------------------
"It took the computing power of three C-64s to fly to the Moon.
It takes a 486 to run Windows 95. Something is wrong here."

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]