North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

worm information

  • From: Christopher J. Wolff
  • Date: Sat Apr 10 11:38:29 2004

Hello,

Over the last few days I've seen a number of hosts attempt to initiate TCP
connections to the following ports in sequence.

80
139
445
6129
3127
1025
135
2745
...repeat.

At this moment I haven't seen a correlation between this activity and the
port exploitation list on CERT.  Any insight would be appreciated, thank
you.

Regards,
Christopher J. Wolff, VP CIO
Broadband Laboratories, Inc.
http://www.bblabs.com