[Dshield] Record numbers of new open proxy ports

Paul Marsh pmarsh at nmefdn.org
Mon Mar 1 20:53:19 GMT 2004


 Sorry for the ignorant question but can you give some details on how
you came up with this information.  I'm not questioning you, I'm just
curious, inquiring minds want to know :)

Thanx, Paul

> -----Original Message-----
> From: Jon R. Kibler [mailto:Jon.Kibler at aset.com] 
> Sent: Monday, March 01, 2004 02:59 PM
> To: list at dshield.org
> Subject: [Dshield] Record numbers of new open proxy ports
> 
> Hello all:
> 
> Well, one of these new worms is setting records for the 
> number of new open proxies it is creating. Thus far today, 
> the number of new open proxies we are finding each hour is 
> over 3x the norm. Each hour we are finding more new open 
> proxies than we did the previous hour.
> 
> The new open proxies appear to be primarily on these ports (all tcp):
> 	1080
> 	6588
> 	4480
> 	8080
> 	8081
> 
> We are also observing a larger than normal number of open proxies on:
> 	  23
> 	  80
> 	8100
> 
> It appears that 1080 and 6588 are occurring in pairs (over 
> 50% of all observed) and that 1080 ad 4480 are also paired.
> 
> Just a heads-up.
> 
> Jon
> --
> Jon R. Kibler
> Chief Technical Officer
> A.S.E.T., Inc.
> Charleston, SC  USA
> (843) 849-8214
> 
> 
> 
> 
> ==================================================
> Filtered by: TRUSTEM.COM's Email Filtering Service
> http://www.trustem.com/
> No Spam. No Viruses. Just Good Clean Email.
> 
> 




More information about the list mailing list