Security Incidents mailing list archives

Re: lots of interest in port 109 (POP2)

From: harikiri () EL8 ORG (harikiri)
Date: Tue, 7 Mar 2000 07:17:08 -0800


I can't comment on why POP-2 has become so popular all of a sudden, but I
can also confirm that a client of mine has seen a sweep of its class C for
the service - at two different times, from two unique ip's.

-h

--
"Unless you enter the tiger's lair, you cannot get hold of the tiger's cubs."

On Mon, 6 Mar 2000, Russell Fulton wrote:

Greetings All,
              Over the last couple of days I have seen several scans
of our address space for port 109.  This includes a slow scan the same
as Keith Owens reported on the 25 Feb <5814.951427814 () ocs3 ocs-net>.

Does anyone know why port 109 is suddenly so popular?

Cheers, Russell

Current thread:

lots of interest in port 109 (POP2) Russell Fulton (Mar 05)
- Re: lots of interest in port 109 (POP2) harikiri (Mar 07)
  - Re: lots of interest in port 109 (POP2) Jon Lewis (Mar 08)
- Re: lots of interest in port 109 (POP2) Pavel Kankovsky (Mar 08)
  - Re: lots of interest in port 109 (POP2) Juan M. Courcoul (Mar 08)
    - Re: lots of interest in port 109 (POP2) drkn (Mar 14)
    - Syn and Fin in different packets together Stuart Staniford-Chen (Mar 21)
    - Re: Syn and Fin in different packets together Simple Nomad (Mar 22)
    - Re: Syn and Fin in different packets together Granquist, Lamont (Mar 24)
    - Dramatic increase in UDP Port 137 (NetBIOS Name Service) probe activity Jeffrey D. Carter (Mar 25)
    - Re: Dramatic increase in UDP Port 137 (NetBIOS Name Service) probeactivity Bryan Andersen (Mar 28)
    - Re: Dramatic increase in UDP Port 137 (NetBIOS Name Service) probeactivity Christoph Schneeberger (Mar 29)

(Thread continues...)