[Dshield] 2967/TCP (SSC-AGENT) Scans

Robert Nelson nelsrob at mts.net
Mon Jan 8 01:59:45 GMT 2007


I'm wondering if some little bot/trojan/whatever isn't busy scanning. I've noticed scans of that port on my local DSL neighborhood,
too, along with 5900, 445, 135, 139, 1433...

Robert

-----Original Message-----
From: list-bounces at lists.dshield.org [mailto:list-bounces at lists.dshield.org] On Behalf Of Jon R. Kibler
Sent: January 7, 2007 1:11 PM
To: General DShield Discussion List
Subject: [Dshield] 2967/TCP (SSC-AGENT) Scans


Hi,

Just looked at weekly scan stats. Port 2967/tcp is now the top blocked port and  almost 1.5x the number of VNC scans, the next most
frequently scanned port. (Most amazing, ssh scans have dropped to 10th place!)

Is there a new Symantec exploit, or is this still trying to exploit the vulnerability first reported last summer?

Jon
-- 
Jon R. Kibler
Chief Technical Officer
A.S.E.T., Inc.
Charleston, SC  USA
(843) 849-8214



More information about the list mailing list