Security Incidents mailing list archives
Logs: Many hits with source port of 80
From: "Byrne Ghavalas" <security () nscs uk com>
Date: Fri, 13 Dec 2002 10:05:56 -0000
Hi All, Has anyone else noticed a high number of hits in their security logs, where the source port is set to tcp 80 and the destination port is some high tcp port? I have noticed that these events seem to be getting more numerous than the NetBios scans ;-) For example: 2002-12-13 09:08:04 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:07:04 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:06:05 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:05:04 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:04:04 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:03:05 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:02:04 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:01:28 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:01:10 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:01:01 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:00:57 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:00:55 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:00:54 194.78.225.36:80 XX.XX.XX.XX:29439 2002-12-13 09:00:54 194.78.225.36:80 XX.XX.XX.XX:29439 It appears to be some kind of automated scan as the time of each entry appears to follow a pattern. Byrne Ghavalas ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Logs: Many hits with source port of 80 Byrne Ghavalas (Dec 15)
- Re: Many hits with source port of 80 Maxime Ducharme (Dec 16)
- Re: Logs: Many hits with source port of 80 Valdis . Kletnieks (Dec 16)
- RE: Logs: Many hits with source port of 80 James C Slora Jr (Dec 16)
- Re: Logs: Many hits with source port of 80 Byrne Ghavalas (Dec 16)
- Re: Logs: Many hits with source port of 80 Kevin Bowman (Dec 16)
- RE: Logs: Many hits with source port of 80 James C Slora Jr (Dec 16)
- Re: Logs: Many hits with source port of 80 Byrne Ghavalas (Dec 16)
- Re: Logs: Many hits with source port of 80 Russell Fulton (Dec 16)
- Re: Logs: Many hits with source port of 80 Joe Stewart (Dec 16)