Port 6667 & 10.0.1.128/1.1.1.1/1.3.3.7

From: ex-Zephion (dl1west-nospam_at_yahoo.com)
Date: 09/18/03

  • Next message: donut: "Re: Mozilla Browser 1.5b - secure ?"
    Date: Thu, 18 Sep 2003 11:32:06 -0400
    
    

    Hello,

    I'm seeing a lot of traffic trying to leave my firewall destined for
    port 6667 at the IPs 10.0.1.128, 10.10.10.10, 1.1.1.1 and 1.3.3.7
    (sounds like l337/elite to me :-).

    Yes - I know the 10.x.x.x traffic isn't going too far.... RFC1918, etc,
    etc.

    Various Google searches and searches on the various A/V sites haven't
    turned up a definite answer - just more questions about the same thing.

    Can anyone clue me in to the exact trojan/worm/virus this may be and/or
    if they're seeing the same kind of traffic.

    Any insight is appreciated....

    Thanks.

    B


  • Next message: donut: "Re: Mozilla Browser 1.5b - secure ?"