On Tue, 2003-12-02 at 03:10, Rodrigues, Philip wrote: > I'm sitting in front of two Class B's. We saw a steady increase in the unique > external IPs scanning us for UDP 1026, 1030 today since 0700 EST. This chart > shows the number of unique external IPs with incoming UDP 1026 traffic per hour > since noon.
This was discussed this month on some french security related newsgroups, and it seems that most of the scans have a source port of 666/UDP. I captured some packets and it appears to be (only) a Windows Messenger "spam" for a "penis enlargement" product. F*cking spammers ... -- Nicob <[EMAIL PROTECTED]> _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
