[Dshield] Port 7965?

Rod Carty rod at en-consult.ca
Thu Jan 1 20:53:32 GMT 2004


jayjwa wrote:

>A noticed this (see attachment) at about 15 minutes to midnight, tons of
>attempts to connect to port 7965. As far as I can tell, that's not a known
>trojan port, or is it? Any idea why this host wants so badly to connect?
>My fw blocked it, and I've since banned that host by IP, but this
>just seems too odd, being that I've never had anything to do with that
>host. It's running a ftp, http, mysql, and mail server. I briefly checked
>the website using lynx and it seems to be some kind of ad. 5 minutes later
>and its generating tons of blocked host violations.
>
>[jayjwa]
>
>  
>
VNC uses 7900 as it's root port, and you can change that to 79XX within 
the program. It could be that someone had the wrong IP address and was 
trying to connect to another computer with VNC.

-- 
Rod C--
http://www.en-consult.ca
http://www.newlifefmyukon.ca

>> Time may be a great healer but it's also a lousy beautician. <<
The preceding humor inserted by QuipSig
http://www.en-consult.ca/quipsig/





More information about the list mailing list