[Dshield] Port 1026

Bill McCarty bmccarty at pt-net.net
Sat Jan 3 03:23:17 GMT 2004

Hi all,

The current (Jan 02) handler's diary asks for reports of traffic on port 
1026. On my class C, I've seen 33 datagrams targeting this port today. Of 
these, 31 have been pop-up spam related to PlayersEdge.us. The remaining 2 
have the 0x0000 payload associated last month with PopAdStop.com. My hosts 
don't respond to the 0x0000 probes, so I can't readily determine whether 
the sources of these probes are hosting the nasty program some folks 
downloaded from PopAdStop.com last month.

Yesterday, I saw no traffic inbound to port 1026. So, on my network, both 
these two sorts of traffic have increased significantly in comparison to 
the previous day.


Bill McCarty

More information about the list mailing list