full-disclosure - Increase probe on UDP port 1026

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1070356583.1108.27.camel@bobby.exaprobe.com>
From: nicob at nicob.net (Nicob)
Subject: Increase probe on UDP port 1026

On Tue, 2003-12-02 at 03:10, Rodrigues, Philip wrote:
> I'm sitting in front of two Class B's.  We saw a steady increase in the unique
> external IPs scanning us for UDP 1026, 1030 today since 0700 EST.  This chart
> shows the number of unique external IPs with incoming UDP 1026 traffic per hour
> since noon.

This was discussed this month on some french security related
newsgroups, and it seems that most of the scans have a source port of
666/UDP.

I captured some packets and it appears to be (only) a Windows Messenger
"spam" for a "penis enlargement" product.

F*cking spammers ...

-- 
Nicob <nicob@...ob.net>