[69398] in North American Network Operators' Group
worm information
daemon@ATHENA.MIT.EDU (Christopher J. Wolff)
Sat Apr 10 11:36:36 2004
From: "Christopher J. Wolff" <chris@bblabs.com>
To: "'nanog list'" <nanog@merit.edu>
Date: Sat, 10 Apr 2004 08:35:51 -0700
Errors-To: owner-nanog-outgoing@merit.edu
Hello,
Over the last few days I've seen a number of hosts attempt to initiate TCP
connections to the following ports in sequence.
80
139
445
6129
3127
1025
135
2745
...repeat.
At this moment I haven't seen a correlation between this activity and the
port exploitation list on CERT. Any insight would be appreciated, thank
you.
Regards,
Christopher J. Wolff, VP CIO
Broadband Laboratories, Inc.
http://www.bblabs.com
