Security Incidents mailing list archives

AdForce hitting odd ports

From: RTORTORE () MOBIUS COM (Rick Tortorella)
Date: Fri, 11 Feb 2000 15:24:46 -0500


Sorry, this is kind of off base.  It's not an intrusion attempt (unless I
really made a mistake!).

Can someone explain to me, probably off list, why adforce attempts to make
connections on high numbered ports?  I'm getting a lot of drops on our
firewall from adforce on high port numbers.

40277
40399
40495
42569

These are the frequently tried port numbers.

I think that these dropped requests are due to users going to websites that
have adforce banners on them:  But I'm not clued in to why adforce then
initiates a connection on the above mentioned ports.

Any help/advice/direction would be appreciated.

Thank you!

-Rick

Current thread:

Re: Recent DDoS (was Ping flood? Whats the point?), (continued)
- - - Re: Recent DDoS (was Ping flood? Whats the point?) Eivind Eklund (Feb 11)
    - SSH2 Exploit? Jonathan A. Zdziarski (Feb 09)
    - Re: SSH2 Exploit? Alexander Kiwerski (Feb 10)
    - Re: SSH2 Exploit? Richard Trott (Feb 10)
    - Re: SSH2 Exploit? Thiago/c0nd0r (Feb 11)
    - Re: SSH2 Exploit? Jonathan A. Zdziarski (Feb 11)
    - Re: SSH2 Exploit? Thiago/c0nd0r (Feb 11)
    - Re: SSH2 Exploit? Mike Tancsa (Feb 15)
    - Re: SSH2 Exploit? //Stany (Feb 16)
    - Re: SSH2 Exploit? sysadmin (Feb 16)
    - AdForce hitting odd ports Rick Tortorella (Feb 11)
    - UDP to 161 CL: Nelson, Jeff (Feb 10)
    - Re: UDP to 161 Pavel Kankovsky (Feb 15)
    - Re: UDP to 161 Ryan Russell (Feb 15)
    - Re: UDP to 161 CyberPsychotic (Feb 16)
    - Re: UDP to 161 Russell Fulton (Feb 15)
    - Re: Private networks and home.{net|com} Andy Smith (Feb 09)
    - massive unapproved AXFR's and odd rcvd NOTIFY's Paul Wouters (Feb 09)
    - Re: massive unapproved AXFR's and odd rcvd NOTIFY's Francis A. Vidal (Feb 09)
    - [UPDATE]Dos Trojan on Solaris Roderick Padilla (Feb 09)
    - Re: [UPDATE]Dos Trojan on Solaris Ross Mueller (Feb 09)

(Thread continues...)