FYI...from the Internet Storm Center:
- http://isc.sans.org/...date=2004-06-23
Updated June 23rd 2004 22:30 UTC
"------------------
Scanning for Dabber
-------------------
Over the past couple of days there has been a large rise in port 9898 activity reported ( http://www.dshield.o...t.php?port=9898 ). The Dabber worm (which rides in on the coattails of Sasser) opens a listener on port 9898, which is then probed by the attacking system to confirm its success. We're unaware of any "counter-counter" worm that is looking for Dabber backdoors, but I have seen a significant rise in scanning for it, as well...Likely, someone is harvesting lists for later use..."
Increase in Port 9898 scans
Started by AplusWebMaster, Jun 23 2004 10:08 PM
No replies to this topic
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
