Brian,

I have seen an increase of hits on our firewall and border routers for both
TCP 27374 (sub-7) and also TCP port 12345. I know UDP port 12345 was used
for netbus, but I am seeing TCP 12345. The scans have been from the same
host, usually TCP 27374, followed by TCP 12345. I am still seeing more hits
on TCP 27374 then TCP 12345, about 88 to 6 for the last 4 days.

-----Original Message-----
From: Brice Carlson [mailto:tuck167hotmail.com]
Sent: Tuesday, November 13, 2001 11:23 PM
To: incidentssecurityfocus.com
Subject: SUB7 (update) Now Netbus too!

I send off the file to all those who requested and there has been a few
updates since...

one, i orginal IRC stated was WRONG.

irc.ozmatrix.com
chat.ozmatrix.com

They also have a web site.

http://www.geocities.com/ircx_chat/

um, now its scanning for port 12345 along with scanning for sub7.

Anyone pick up an increase in scans in port 12345 let me know...

Thanks
Brice Carlson

_____

If i was supposed to of emailed you the program and you didn't recieve it
please email me again. put sub7 in the subject and make it caps. Tis i only
got 400 emails a day. Thanks...

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]