Re: Subseven Scans

From: H C (keydet89@yahoo.com)
Date: 08/12/02


Date: Mon, 12 Aug 2002 11:11:01 -0700 (PDT)
From: H C <keydet89@yahoo.com>
To: Rob Keown <Keown@MACDIRECT.COM>, incidents@securityfocus.com

Rob,

Can you be more specific? When you say "subseven
scans" are you referring to the default port? If so,
how do you know they were intended for subseven, and
not the Linux worm (Lion or Ramen, I can't remember
which) that utilized the same port?

Just curious as to what other info you can
provide...assuming, of course, that you're not simply
talking about SYN packets that got dropped at the
firewall...

Thanks

--- Rob Keown <Keown@MACDIRECT.COM> wrote:
> Anyone else seeing a huge increase in subseven
> scans...6708 since about
> 0300Z - across all of my class C's and from quite a
> few sources (running the
> query now to see how many).
>
> Rob
>
>
>
----------------------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS
> analyzer service.
> For more information on this free incident handling,
> management
> and tracking system please see:
> http://aris.securityfocus.com
>

__________________________________________________
Do You Yahoo!?
HotJobs - Search Thousands of New Jobs
http://www.hotjobs.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com



Relevant Pages

  • Re: Worm1800.exe on UnderNet?
    ... :!Notice!: A Recent Port Scan on your Computer reveals that Port 1800 ... For more information on this free incident handling, management ... and tracking system please see: http://aris.securityfocus.com ...
    (Incidents)
  • RE: Increased connects to Port 1433
    ... Increased connects to Port 1433 ... For more information on this free incident handling, management ... and tracking system please see: http://aris.securityfocus.com ...
    (Incidents)
  • Re: Port 6635
    ... >We received a very fast scan for port 6635 last night. ... >For more information on this free incident handling, management ... >and tracking system please see: http://aris.securityfocus.com ...
    (Incidents)
  • RE: A small quandary
    ... This list is provided by the SecurityFocus ARIS analyzer service. ... and tracking system please see: http://aris.securityfocus.com ... For more information on this free incident handling, management ...
    (Incidents)
  • RE: Anyone seen this before?
    ... The answer to this is, in task manager, you can right click on any app ... > For more information on this free incident handling, management ... > and tracking system please see: http://aris.securityfocus.com ...
    (Incidents)