[Dshield] PORT 22321
Simon at wretched.demon.co.uk
Tue Sep 30 11:10:12 GMT 2003
-----BEGIN PGP SIGNED MESSAGE-----
Came across a remote server apparently cracked with this port listening.
Not sure it has any significance or not, but when I pulled up the
dshield 70 day log for this port it has a pretty distinctive shape.
Big peak, followed by little peak 2 days later, there are two of these
in the 70 day view.
Does anyone know why?
My immediate thought was it is some sort of search engine, or similar,
but the number of sources and targets increases, almost like peer to
peer or distributed network activity.
As far as I know it is supposed allocated to some sort of oriental
character input software, 22321 supporting Taiwanese (which seems very
unlikely in the country his server is located), but I don't know much
about WNN, and most of the explanations seem to be in Japansese.
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----
More information about the list