[unisog] Increased Activity

Brian Eckman eckman at umn.edu
Wed Mar 24 14:44:39 GMT 2004

Lang, Michael wrote:
> Hey everyone,
> This is my first post to unisog and I just subscribed, - I hope that this isn't repetitive...
> This morning I see a dramatic increase in hosts on our network that are scanning for 
> tcp 2745
> tcp 1025
> tcp 3127
> tcp 6129
> tcp   80
> The attacked IP is chosen pretty random with the first octet staying the same and the last three changing.
> Not only is there a dramatic increase of hosts on our network getting this, but I see a lot from the Internet pouring into our network.
> Anyone clue me into what this one is?

Polybot (a.k.a. Phatbot). It's being going on for a couple of weeks now.


Brian Eckman
Security Analyst
OIT Security and Assurance
University of Minnesota

"There are 10 types of people in this world. Those who
understand binary and those who don't."

More information about the unisog mailing list