RE: SUB7 (update) Now Netbus too!

["Davis, Scott" <Scott_Davis () troweprice com>]

Brian, 

I have seen an increase of hits on our firewall and border routers for both
TCP 27374 (sub-7) and also TCP port 12345.  I know UDP port 12345 was used
for netbus, but I am seeing TCP 12345.  The scans have been from the same
host, usually TCP 27374, followed by TCP 12345. I am still seeing more hits
on TCP 27374 then TCP 12345, about 88 to 6 for the last 4 days.  

-----Original Message-----
From: Brice Carlson [mailto:tuck167 () hotmail com]
Sent: Tuesday, November 13, 2001 11:23 PM
To: incidents () securityfocus com
Subject: SUB7 (update) Now Netbus too!


I send off the file to all those who requested and there has been a few 
updates since...

one, i orginal IRC stated was WRONG.

irc.ozmatrix.com
chat.ozmatrix.com

They also have a web site.

http://www.geocities.com/ircx_chat/

um, now its scanning for port 12345 along with scanning for sub7.

Anyone pick up an increase in scans in port 12345 let me know...

Thanks
Brice Carlson

_____

If i was supposed to of emailed you the program and you didn't recieve it 
please email me again. put sub7 in the subject and make it caps. Tis i only 
got 400 emails a day. Thanks...

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com