Security Incidents mailing list archives

Re: anyone else seen an increase in sunrpc scans these days?


From: Ray Simard <ray () SYLVAN-GLADE COM>
Date: Sun, 14 Jan 2001 23:14:11 -0800

On Mon, 15 Jan 2001 02:26:21 +0200, Alex Popa <razor () LDC RO>
wrote:

In the last five days, the port scans to my entire class C have dramatically
increased, from one per two days on average, to four yesterday and six today.

Is there a new exploit around, or is there some sort of new worm out there?

I might just be paranoid, but here are the addreses that have been looking
for port 111 in the last 26 hours:

24.26.121.156
24.168.66.119
64.31.226.156
142.169.227.102
193.226.15.15
211.218.144.11

Yes. It's not unusual lately to get two or three a day on my
little /27. Not long ago it was more like a few a week.

I don't have time at the moment to check the addresses, but I
will tomorrow.

Ray Simard
ray () sylvan-glade com


Current thread: