[Dshield] Sub7 / port 27374

Tom Liston tliston at premmag.com
Thu Jul 11 19:20:37 GMT 2002


I can confirm that Korea seems to be a primary source.  I did a 
fuller check of logs for the last 24 hours.  These are the source IPs 
for scans of port 27374 along with their country of origin.

218.55.44.48 - KR
66.66.53.96 - RoadRunner
211.208.6.127 - KR
12.232.221.128 - AT&T ITS
211.222.85.211 - KR
218.51.17.92 - KR
211.199.134.173 - KR
211.221.180.225 - KR
203.232.52.51 - KR
211.202.94.251 - KR
218.48.116.52 - KR
211.198.89.248 - KR
211.219.206.35 - KR
211.196.127.224 - KR
211.193.179.122 - KR
211.225.63.186 - KR
203.240.154.119 - KR
217.129.182.169 - PORTUGAL
62.82.192.152 - SPAIN
211.186.173.74 - KR
218.149.66.183 - KR

-TL

On 11 Jul 2002 at 13:54, Richard  Golodner wrote:

> 
> 	RipTech Managed Security Services had sent me an email stating that
> Sub-Seven scans were on the up-swing with a noted trend that the majority of
> these scans were originating from Korea. 
> 						Rich
> 
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list


Tom Liston, GSEC
Network Administrator
Prem Magnetics, Inc.
tliston at premmag.com
tliston at hackbusters.net




More information about the list mailing list