Re: Port 119 Scans

["Richard Johnson" <rdump () river com>]

At 14:58 -0600 on 7/27/01, Tom Laermans wrote:
> Hi,
>
> I'm seeing a lot of port 199 scans lately (very many the last week) .. Is
> there some sort of news server exploit out? Or am I the only one seeing this?
>
> I'm on ADSL with dynamic IP so I don't think they'd be targetting me
> personally.. I don't run a newsserver...


I've seen the same, and heard reports from friends about port 119 scans.

It may not be someone looking to run a new exploit.  Hipclones may just be
looking for more open sewers for their newsgroup flooding attacks.


Richard



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com