jayjwa at atr2.ath.cx
Sat Apr 24 08:13:48 GMT 2004
On Fri, 23 Apr 2004, Ed Truitt wrote:
> Subject: Re: [Dshield] 4899
> Over the past 30 days, I have been hot on this port every day. The top
> number of probes has been > 11,000, 28 of the other days have been
> between 1,000 and 10,000 probes. Right now, it is number 7 on the "top
> trends" list (just above 3127 - MyDoom.) The details can be seen at
Funny, I noticed this today too. I found a few links for it, but nothing
too note-worthy. I took a look at the last most recent connection attempt
to that port, and it ended up being a Windows 2k server. It looked well
maintained, not the un-firewalled worm-pot I've come to expect.
Heard: "On 2 recent occasions a "windows update" broke windows.
Once it disabled the NIC altogether and on another occasion it
caused IE to run slower than a one legged cat, trying to bury
a turd on a frozen pond."
More information about the list