[Intrusions] Port Scanning on 1026 & 1027

Hal hmarshal at magreenwood.com
Wed Jul 27 15:24:34 GMT 2005


I'm seeing a fair amount of consistent scans to those ports, beginning around 2:00 CST on the 26th, but wouldn't say tremendous. From here they were coming in at 15 min. intervals or more, and are tapering off this morning. Majority are from 222.141.102.13. Quick check shows that as CNCGROUP Henan province network, China Network Communications Group Corporation, Beijing, CN. I don't have any packets captured, etc.. Hope this helps.

Hal Marshall
IT Manager
Greenwood & Associates

-----Original Message-----
From: intrusions-bounces at lists.sans.org
[mailto:intrusions-bounces at lists.sans.org]On Behalf Of Tony Tomasello
Sent: Tuesday, July 26, 2005 2:15 PM
To: intrusions at lists.sans.org
Subject: [Intrusions] Port Scanning on 1026 & 1027


Guys,

I have noticed a tremendous amount of scanning on ports 1026 and 1027. Not 
sure if you all have been experiencing the same. Is this something that I 
should be concerned about ?

Thanks,
Tony T.


_______________________________________________
Intrusions mailing list
Intrusions at lists.sans.org
http://www.dshield.org/mailman/listinfo/intrusions




More information about the Intrusions mailing list