[Dshield] port 27374

Keith Bergen keith at keithbergen.com
Tue Oct 14 15:34:48 GMT 2003


I have seen fairly constant probes on that port, but at the 
end of September and beginning of October, the probes 
increased dramatically. They are now back to "normal" again. 
Check out my graph on it.

http://www.keithbergen.com/cgi-bin/27374graph.pl

Keep in mind that I am on a Dynamic IP, and subject to probes 
of whatever ports the previous owner had open when I take 
over the IP. I think that 27374 is the "Subseven" virus port.

Keith.

---- Original message ----
>Date: Tue, 14 Oct 2003 08:02:55 -0700 (PDT)
>From: Richard Caasi <caasi at gort.ucsd.edu>  
>Subject: [Dshield] port 27374  
>To: list at dshield.org
>
>
>Recently I received a number of probes to port 27374.
>Anyone else see these?
> 
>Earliest such alert at 06:55:13 on 10/13/2003
>Latest such alert at 01:58:32 on 10/14/2003
> 
>TCP ******S* scan 31 sources 101 destinations

[snip for brevity]




More information about the list mailing list