[Dshield] port 27374

Matthew Harrell mhar at plex.com
Tue Oct 14 15:32:19 GMT 2003


I've been seeing them for a while in large quantities.  I seem to recall
when I looked it up that it's the Subseven worm.


-----------------
Matt Harrell
Plexus Systems
mhar at plex.com 

----- On 10/14/2003 11:20 AM, Richard Caasi <caasi at gort.ucsd.edu> wrote: 
>
> Recently I received a number of probes to port 27374.
> Anyone else see these?
>  
> Earliest such alert at 06:55:13 on 10/13/2003
> Latest such alert at 01:58:32 on 10/14/2003
>  
> TCP ******S* scan 31 sources 101 destinations
>  
> Source          # Alerts (sig) # Alerts (total) # Dsts (sig) # Dsts 
> (total)
> 66.168.101.67   64             64               64           64
> 172.152.15.182  62             62               62           62
> 68.120.193.167  61             61               47           47
> 81.34.114.218   59             59               59           59
> 24.118.171.122  57             57               57           57
> 172.158.202.139 45             45               45           45
> 217.84.55.111   44             44               44           44
> 216.251.178.73  41             41               41           41
> 4.46.0.52       40             40               40           40
> 80.184.145.121  27             27               27           27
> 65.93.66.57     26             26               26           26
> 68.42.172.243   24             24               24           24
> 62.64.200.229   22             22               22           22
> 213.23.133.70   20             20               20           20
> 24.55.13.7      20             20               20           20
> 65.93.66.122    20             20               20           20
> 206.149.36.4    20             20               20           20
> 213.131.150.62  19             19               19           19
> 81.38.152.233   19             19               19           19
> 217.85.216.139  19             19               19           19
> 213.47.7.176    17             17               17           17
> 65.93.69.213    17             17               17           17
> 24.30.235.225   17             17               17           17
> 62.163.180.166  15             15               15           15
> 24.218.253.91   13             13               13           13
> 172.177.118.26  13             13               13           13
> 151.197.92.7    10             10               10           10
> 217.209.162.107 10             10               10           10
> 63.139.28.97    10             10               10           10
> 24.58.171.77    10             10               10           10
> 68.48.166.29    5              5                5            5
> 
> -rc
> 
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list
> 
> 


More information about the list mailing list