Full Disclosure mailing list archives
RE: Increase probe on UDP port 1026
From: Nicob <nicob () nicob net>
Date: Tue, 02 Dec 2003 10:16:23 +0100
On Tue, 2003-12-02 at 03:10, Rodrigues, Philip wrote:
I'm sitting in front of two Class B's. We saw a steady increase in the unique external IPs scanning us for UDP 1026, 1030 today since 0700 EST. This chart shows the number of unique external IPs with incoming UDP 1026 traffic per hour since noon.
This was discussed this month on some french security related newsgroups, and it seems that most of the scans have a source port of 666/UDP. I captured some packets and it appears to be (only) a Windows Messenger "spam" for a "penis enlargement" product. F*cking spammers ... -- Nicob <nicob () nicob net> _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Increase probe on UDP port 1026 Irwan Hadi (Dec 01)
- Re: Increase probe on UDP port 1026 srenna (Dec 01)
- Re: Increase probe on UDP port 1026 bowwow (Dec 03)
- <Possible follow-ups>
- RE: Increase probe on UDP port 1026 Rodrigues, Philip (Dec 01)
- RE: Increase probe on UDP port 1026 Nicob (Dec 02)
- RE: Increase probe on UDP port 1026 Rodrigues, Philip (Dec 02)
- Re: Increase probe on UDP port 1026 Paul Dokas (Dec 02)
- Re: Increase probe on UDP port 1026 George Capehart (Dec 02)
- Re: Increase probe on UDP port 1026 Nick FitzGerald (Dec 02)
- RE: Increase probe on UDP port 1026 Bill Royds (Dec 02)
- Re: Increase probe on UDP port 1026 Brian Eckman (Dec 03)
- RE: Increase probe on UDP port 1026 Nicob (Dec 02)