[Intrusions] Port Scanning on 1026 & 1027

Dan Parmelee dan.parmelee at gmail.com
Wed Jul 27 15:07:18 GMT 2005

1026/1027 are generally used for Messenger spamming. I always run a small
program on every machine called MessengerDisable that flat out removes
Messenger (since disabling the service doesn't do enough).

Hope this helps.


Dan Parmelee 

-----Original Message-----
From: intrusions-bounces at lists.sans.org
[mailto:intrusions-bounces at lists.sans.org] On Behalf Of Tony Tomasello
Sent: Tuesday, July 26, 2005 2:15 PM
To: intrusions at lists.sans.org
Subject: [Intrusions] Port Scanning on 1026 & 1027


I have noticed a tremendous amount of scanning on ports 1026 and 1027. Not
sure if you all have been experiencing the same. Is this something that I
should be concerned about ?

Tony T.

Intrusions mailing list
Intrusions at lists.sans.org

More information about the Intrusions mailing list