Cable Forum - View Single Post - Unusual port activity: Friend or Foe? [213.106.113.200]

Matth · 03-09-2004, 22:16

Yep! That address is a regular "typhoid mary" and is going to be puking that crap across all the local IP addresses and then some - the 2745 local port, and 1025, and let me check my firewall for other examples of commonly atacked ports - I set my firewall to give special attention, since I regard the activity as akin to trying doorhandles - try 3 of mine, and a 15min block on ALL activity from that address descends, eveen if it would be passes by all other rules ... in Outpost Firewall, you can adjust the rating of ports, so that commonly probed ports trigger an alert/evasion more easily.

1025-1028
2745
3127
5554
6129
9898

Hostile activity - probing for open ports that belong to remote access trojans, or otherwise compromise the system.

Your firewall is doing what it's meant to, stopping them and logging them - that address, therefore belongs to either an unwitting trojan infectee, or maybe even to someone mastering their own set of "owned" victims.

03-09-2004, 22:16	#9
Matth Inactive Join Date: Mar 2004 Services: BB:M, TV:XL, Phone:M, Loyalty Posts: 2,516	Re: Unusual port activity: Friend or Foe? [213.106.113.200] Yep! That address is a regular "typhoid mary" and is going to be puking that crap across all the local IP addresses and then some - the 2745 local port, and 1025, and let me check my firewall for other examples of commonly atacked ports - I set my firewall to give special attention, since I regard the activity as akin to trying doorhandles - try 3 of mine, and a 15min block on ALL activity from that address descends, eveen if it would be passes by all other rules ... in Outpost Firewall, you can adjust the rating of ports, so that commonly probed ports trigger an alert/evasion more easily. 1025-1028 2745 3127 5554 6129 9898 Hostile activity - probing for open ports that belong to remote access trojans, or otherwise compromise the system. Your firewall is doing what it's meant to, stopping them and logging them - that address, therefore belongs to either an unwitting trojan infectee, or maybe even to someone mastering their own set of "owned" victims.