[Dshield] port 80 increase

Rick Klinge rick at jaray.net
Mon Dec 8 01:02:33 GMT 2003


We've have an active DoS via 200.204.198.208/brazil for some unknown reason.
4 packet flood to port 80 with consistent frequency.. sync flood?

Rick

> -----Original Message-----
> From: list-bounces at dshield.org [mailto:list-bounces at dshield.org]On
> Behalf Of Johannes B. Ullrich
> Sent: Sunday, December 07, 2003 3:44 PM
> To: list at dshield.org
> Subject: [Dshield] port 80 increase
>
>
>
> A user pointed out a significant increase in the number of sources
> scanning port 80. This is always a sign of "something bad". However, my
> web logs don't show anything unusual.
>
> If you run a web server, please take a couple minutes and scan for
> unusual activity.
>
> --
> CTO SANS Internet Storm Center               http://isc.sans.org
> phone: (617) 786 1563
>   fax: (617) 786 1550                          jullrich at sans.org
>
>

___________________________________________________________________
Virus Scanned and Filtered by http://www.FamHost.com E-Mail System.




More information about the list mailing list