[Dshield] New probe?

Bill McCarty bmccarty at apu.edu
Sat Mar 15 21:07:49 GMT 2003

--On Saturday, March 15, 2003 2:24 PM -0500 "Jon R. Kibler"
<Jon.Kibler at aset.com> wrote:

> We have noticed what appears to be a new probe pattern. The intruder hits
> first port 80 (http), then 57 (what exactly is 57?), then 21 (ftp), in
> that order, and there is about 3 seconds between each probe.
> Any idea what this probe is and what it is trying to accomplish?

The combination of ports suggests that the probes originate from FXScanner:

Bill McCarty

More information about the list mailing list