Security Incidents mailing list archives

Port 3889 Traffic

From: Eric Ceradsky <eric.ceradsky () sbcglobal net>
Date: Fri, 7 May 2004 16:01:47 -0700 (PDT)

I've been seeing a lot of port 3889 traffic externally
lately but haven't been able to dig up any known
issues with that port.. Used to be one address and
overnight tis quickly spawned to several. Brazil, US,
UK, etc. Anyone have any ideas?

May  7 17:43:48   DROP <INPUT:DE  195.132.138.140 ->
X.X.X.X    4055:3889/tcp S  ppp0
May  7 17:43:54   DROP <INPUT:DE  195.132.138.140 ->
X.X.X.X    4055:3889/tcp S  ppp0
May  7 17:45:31   DROP <INPUT:DE  66.42.241.168   ->
X.X.X.X    2402:3889/tcp S  ppp0
May  7 17:45:34   DROP <INPUT:DE  66.42.241.168   ->
X.X.X.X    2402:3889/tcp S  ppp0
May  7 17:45:40   DROP <INPUT:DE  66.42.241.168   ->
X.X.X.X    2402:3889/tcp S  ppp0
May  7 17:45:52   DROP <INPUT:DE  66.42.241.168   ->
X.X.X.X    2402:3889/tcp S  ppp0
May  7 17:46:09   DROP <INPUT:DE  12.5.121.129    ->
X.X.X.X    3915:3889/tcp S  ppp0
May  7 17:46:10   DROP <INPUT:DE  66.42.241.168   ->
X.X.X.X    2423:3889/tcp S  ppp0
May  7 17:46:12   DROP <INPUT:DE  12.5.121.129    ->
X.X.X.X    3915:3889/tcp S  ppp0
May  7 17:46:13   DROP <INPUT:DE  66.42.241.168   ->
X.X.X.X    2423:3889/tcp S  ppp0
May  7 17:46:18   DROP <INPUT:DE  12.5.121.129    ->
X.X.X.X    3915:3889/tcp S  ppp0
May  7 17:46:19   DROP <INPUT:DE  66.42.241.168   ->
X.X.X.X    2423:3889/tcp S  ppp0
May  7 17:46:31   DROP <INPUT:DE  66.42.241.168   ->
X.X.X.X    2423:3889/tcp S  ppp0
May  7 17:47:01   DROP <INPUT:DE  195.132.138.140 ->
X.X.X.X    4363:3889/tcp S  ppp0
May  7 17:47:04   DROP <INPUT:DE  195.132.138.140 ->
X.X.X.X    4363:3889/tcp S  ppp0
May  7 17:47:10   DROP <INPUT:DE  195.132.138.140 ->
X.X.X.X    4363:3889/tcp S  ppp0

Thanks

---------------------------------------------------------------------------
----------------------------------------------------------------------------

Current thread:

Port 3889 Traffic Eric Ceradsky (May 10)
- Re: Port 3889 Traffic kang (May 10)
  - RE: Port 3889 Traffic Samuel Petreski (May 10)
    - Re: Port 3889 Traffic kang (May 10)
  - Re: Port 3889 Traffic KUIJPERS Jimmy (May 10)
- <Possible follow-ups>
- RE: Port 3889 Traffic Josh.Berry (May 10)
  - Re: Port 3889 Traffic Francisco J. Pecorella R. (May 10)
    - RE: Port 3889 Traffic Rob Shein (May 10)
- RE: Port 3889 Traffic Meidinger Chris (May 10)
- RE: Port 3889 Traffic sk3tch (May 10)
- Re: Port 3889 Traffic Eric Ceradsky (May 11)

(Thread continues...)