[Dshield] 2967/TCP (SSC-AGENT) Scans
nelsrob at mts.net
Mon Jan 8 01:59:45 GMT 2007
I'm wondering if some little bot/trojan/whatever isn't busy scanning. I've noticed scans of that port on my local DSL neighborhood,
too, along with 5900, 445, 135, 139, 1433...
From: list-bounces at lists.dshield.org [mailto:list-bounces at lists.dshield.org] On Behalf Of Jon R. Kibler
Sent: January 7, 2007 1:11 PM
To: General DShield Discussion List
Subject: [Dshield] 2967/TCP (SSC-AGENT) Scans
Just looked at weekly scan stats. Port 2967/tcp is now the top blocked port and almost 1.5x the number of VNC scans, the next most
frequently scanned port. (Most amazing, ssh scans have dropped to 10th place!)
Is there a new Symantec exploit, or is this still trying to exploit the vulnerability first reported last summer?
Jon R. Kibler
Chief Technical Officer
Charleston, SC USA
More information about the list