Coordinated scans?

Anderson Johnston andy at umbc.edu
Fri Jun 21 15:23:20 GMT 2002


We've been getting a lot of interest in ports 137, 6970 and 6972 in the
last couple of days.  Anyone else seen this?

					- andy

Summary Log Excerpt:

===================================================================================
                            Scanners by Number of Target IP Addresses
			    -----------------------------------------
Scanner IP		# Targets 		Ports 			Type
-------------------	--------------		-----------		-----------
12.107.142.10  		42      		137 139    		SYN UDP
12.162.137.95  		45      		137        		UDP
64.168.188.15  		52      		137 139    		SYN UDP
65.188.123.154 		95      		137        		UDP
203.145.163.27 		146     		137        		UDP
203.197.210.43 		50      		137        		UDP
205.188.228.1  		34      		6970 6972  		UDP
205.188.228.17 		35      		6970 6972  		UDP
205.188.228.33 		36      		6970 6972  		UDP
205.188.228.65 		37      		6970 6972  		UDP
205.188.228.129		28      		6970       		UDP
205.188.228.145		30      		6970 6972  		UDP
207.225.166.75 		115     		137        		UDP
208.158.2.89   		20      		137        		UDP
217.165.217.28 		50      		137        		UDP


------------------------------------------------------------------------------
** Andy Johnston (andy at umbc.edu)          *            pager: 410-678-8949  **
** Manager of IT Security                 * PGP key:(afj2002) 4096/8448B056 **
** Office of Information Technology, UMBC *   4A B4 96 64 D9 B6 EF E3 21 9A **
** 410-455-2583 (v)/410-455-1065 (f)      *   46 1A 37 11 F5 6C 84 48 B0 56 **
------------------------------------------------------------------------------



More information about the unisog mailing list