Port 6667 & 10.0.1.128/188.8.131.52/184.108.40.206
From: ex-Zephion (dl1west-nospam_at_yahoo.com)
Date: Thu, 18 Sep 2003 11:32:06 -0400
I'm seeing a lot of traffic trying to leave my firewall destined for
port 6667 at the IPs 10.0.1.128, 10.10.10.10, 220.127.116.11 and 18.104.22.168
(sounds like l337/elite to me :-).
Yes - I know the 10.x.x.x traffic isn't going too far.... RFC1918, etc,
Various Google searches and searches on the various A/V sites haven't
turned up a definite answer - just more questions about the same thing.
Can anyone clue me in to the exact trojan/worm/virus this may be and/or
if they're seeing the same kind of traffic.
Any insight is appreciated....