Netbus portscan ( port 12345)

[lmonin () METACONCEPT COM (lmonin () METACONCEPT COM)]

Hi,

        Our networks are regurlarly scanned for any Netbus trojan,
        in the last 3 months, source addresses were :
        200.53.26.152
        203.228.207.118
        210.111.93.12
        210.182.162.87
        210.220.143.172
        210.92.127.215
        211.111.78.3
        211.32.15.203
        211.38.72.87
        211.47.97.210
        211.48.238.105
        211.54.166.234
        211.56.170.25
        211.59.30.202
        211.63.37.164
        212.73.34.51
        213.195.29.198
        213.195.29.201

        Many of these addresses are from Korea, some from Mexico and one
        from Spain...

        Korean scans use a robot ( src port sweeping, dst ip sweeping).

        May be it can help someone.

        

        Laurent MONIN
        lmonin () metaconcept com