[Dshield] New probe?

Bill McCarty bmccarty at apu.edu
Sat Mar 15 21:07:49 GMT 2003


--On Saturday, March 15, 2003 2:24 PM -0500 "Jon R. Kibler"
<Jon.Kibler at aset.com> wrote:

> We have noticed what appears to be a new probe pattern. The intruder hits
> first port 80 (http), then 57 (what exactly is 57?), then 21 (ftp), in
> that order, and there is about 3 seconds between each probe.
> 
> Any idea what this probe is and what it is trying to accomplish?

The combination of ports suggests that the probes originate from FXScanner:
<http://216.239.53.100/search?q=cache:302jVADZlcIC:www.dshield.org/pipermai
l/list/2002-October/001153.html+fx+%22port+57%22&hl=en&ie=UTF-8>.

---------------------------------------------------
Bill McCarty



More information about the list mailing list