Most likely its either someone port scanning the whole range, or a worm looking for vulnerable web servers to infect. The source port means nothing as it just a random high number port when you make an http request. Seeing as how the ip is somewhere in the asian pacific neither would surprise me.
----- Original Message ----- From: "KoRe MeLtDoWn" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, May 08, 2002 11:37 PM Subject: Strange scan and port 80 output from an ip > Hello, > Just a few minutes ago I recieved a scan from the ip address 210.101.95.51 > on port 80 with the source port being port 3021. Two seperate connection > attempts were logged one after the other. > The output from my firewall was as follows: > ----Start Output---- > IP: 210.101.95.51 > Node: ±èâÁØ > NetBIOS: ±èà > Group: WORKGROUP > MAC: 000102FBE16B > DNS: ±èâÁØ > ----End Output---- > If you connect to this Ip on port 80 you get a webpage output that reads the > following:sex0r lowd l33tn3ss > > sex0r geeklab.org > > contact:[EMAIL PROTECTED] > > > The reason I've posted this is because I have been scanned by these people > before, and wanted to know what they were about, and if possible what they > were attempting to do on my machine. > > Thanks in advance for your help > > Peter Francis > > -= KoRe WoRkS =- Internet Security > Owner Operator > http://www.koreworks.com/ > New Zealand > > Is your box REALLY secure? > > > > > _________________________________________________________________ > Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp. >
