Security Incidents mailing list archives
Port scans from CodeRed-infected hosts
From: Kyle Maus <sargon () bigfoot com>
Date: Wed, 08 Aug 2001 10:09:32 -0500
In response to questions, the port scans I am seeing from identified CodeRed-infected hosts are as follows.
UDP 69, 111, 137-138, 2049, various Windows trojan ports TCP 21, 23, 87, 111, 139, 512-515, 540, 6000-6033Standard stuff, but it does concern me that these scans are coming from machines obviously compromised by CodeRed II.
---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service.For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Port scans from CodeRed-infected hosts Kyle Maus (Aug 08)