Jump to content


Increase in Port 9898 scans

  • Please log in to reply
No replies to this topic

#1 AplusWebMaster



  • SWI Friend
  • PipPipPipPipPip
  • 11,104 posts

Posted 23 June 2004 - 09:08 PM

FYI...from the Internet Storm Center:

- http://isc.sans.org/...date=2004-06-23
Updated June 23rd 2004 22:30 UTC
Scanning for Dabber
Over the past couple of days there has been a large rise in port 9898 activity reported ( http://www.dshield.o...t.php?port=9898 ). The Dabber worm (which rides in on the coattails of Sasser) opens a listener on port 9898, which is then probed by the attacking system to confirm its success. We're unaware of any "counter-counter" worm that is looking for Dabber backdoors, but I have seen a significant rise in scanning for it, as well...Likely, someone is harvesting lists for later use..."
.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...

Member of UNITE
Support SpywareInfo Forum - click the button