[Snort-sigs] Re: Odd scans from 192.244.23.1

Andrew Daviel andrew at ...559...
Tue Apr 23 19:48:15 EDT 2002


On Tue, 23 Apr 2002, Robert Wagner wrote:

> Odd scans from 192.244.23.1.  Does anyone know what they are scanning for?
> I don't have a server running at myip.  I have heard this IP address has
> been doing a lot of scanning like this.  Slow scan to avoid detection.

I show (http://andrew.triumf.ca/cgi-bin/port) :
1328  EWALL  echogent.com wireless home networking
2391  3com-net-mgmt tactical-sw.com shared access to remote modems
1888   NC Config Port 
1414   IBM MQSeries - PDF in Google cache by Paul F. Sehorne - MQSeries 
       and Firewalls
1360  MIMER  www.mimer.se  SQL access ??
1559  web2host Stephen Johnson   

so maybe looking for things exploitable as proxies ?


Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376
security at ...560...





More information about the Snort-sigs mailing list