Security Incidents mailing list archives

Portscan X.Y.Z.100 - X.Y.Z.254, various ports

From: hektor () RZ RWTH-AACHEN DE (Jens Hektor)
Date: Sat, 20 May 2000 13:46:26 -0000


Hi,

someone reported in the last weeks a scan starting
or stopping at adress .100 (do not remember exactly, sorry).

Now we had a similar scan, probing for Netbus, Sub7 and X11.
(Netbus was filtered and seen elsewhere).

Here's the compressed log:
** Portscan  ** May 20 14:50:40 - May 20 14:50:59:
149.225.50.X (pec-some-number.tnt8.me2.uunet.de) 
518 tries to 137.226.X.100 - 137.226.X.254 (155), 
Proto: TCP, Ports: 1243 6000 27374

Bye, Jens Hektor

Current thread:

Unidentified Trojan? Richard Ginski (May 18)
- Unidentified Trojan? -- Hope this helps James Wilson (May 19)
- price.doc.exe illu5i0n () HUSHMAIL COM (May 19)
  - Re: price.doc.exe barry.net (May 22)
- Portscan X.Y.Z.100 - X.Y.Z.254, various ports Jens Hektor (May 20)
- Two scans (Klogin and a trojan?) Jose Nazario (May 21)
- Know Your Enemy: A Forensics Analysis Lance Spitzner (May 21)
- <Possible follow-ups>
- Re: Unidentified Trojan? Elliot Perrin (May 18)
- Re: Unidentified Trojan? Bill Royds (May 18)
- Unidentified Trojan? Richard Ginski (May 19)