Download TrojanHunter Now
Free 30-day trial!
Latest TrojanHunter Version:
TrojanHunter 5.0
Order Now
License file delivered within minutes.
Welcome, Guest. Please Login or Register.
Aug 29th, 2008, 5:43pm
   Mischel Internet Security Forum
   Malware
   Trojans (Moderators: Helena, Gavin_Coe, Magnus)
   And today's suspicious port is...		 « Previous topic | Next topic »
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print
   Author  Topic: And today's suspicious port is...  (Read 516 times)
Ian
Stole All the Forum Stars
********



Good things come to those who wait ...

   


Posts: 2907
And today's suspicious port is...
« on: Jun 13th, 2002, 8:39pm »		 Quote Quote  Modify Modify
"Roll up! Roll up! Get your Daily Port 'ere!"
 
TCP port 6635 - I've checked around and many people are reporting this one - a source of scans to their networks - but no one seemed to have tracked down what's causing it!
 
They seem to come from the same limited netblocks (210 - 212; the scans to mine were from 210.126.192.65:6635 to <my IP>:6635 (though some report that the source port was incremental, I've not seen that so far). The best I've come up with was a home-made honeytrap (or possibly a trawler on the lookout for servers to have a go at) - see what you think:- http://archives.neohapsis.com/archives/sf/honeypots/2002-q2/0000.html
 
Any thoughts?
IP Logged
... but crap arrives pretty much straight away.
Friend
 Guest

Email
Re: And today's suspicious port is...
« Reply #1 on: Jan 5th, 2003, 4:04am »		 Quote Quote  Modify Modify   Remove Remove
Ahh, that's an easy one.  PortExplorer by Diamond (http://hop.clickbank.net/hop.cgi?getsecure/diamondcs) idents that as the principle port for SynScan.  
 
Synscan is the scanning engine and vulnerability test used by the following WORMS:  ramen & canserserver and is also found some versions of t0rnscan.    
 
 
IP Logged
Ian
Stole All the Forum Stars
********



Good things come to those who wait ...

   


Posts: 2907
Re: And today's suspicious port is...
« Reply #2 on: Jan 7th, 2003, 9:46pm »		 Quote Quote  Modify Modify
Thanks for the info - and for digging up an old thread! Hopefully, in the 6 months or so since I originally posted, more people have become aware of this - I just stopped trying to find out anything about it some time last July Grin.
 
Cheers!
IP Logged
... but crap arrives pretty much straight away.
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print

« Previous topic | Next topic »
Search
Members
Login
Register