Re: Wingate 1080/8080 Scans

[James Kelty <james () TUNA ORG>]

I only have one, but, then again, my domain has only been live for a week or
two.

Jan 16 18:13:32 zona snort[4159]: [ID 381826 auth.alert]
MISC-WinGate-1080-Attempt: 24.64.182.195:4938 -> 216.218.215.154:1080

-James
----- Original Message -----
From: "Brian Taylor" <drak3 () ATL MEDIAONE NET>
To: <INCIDENTS () SECURITYFOCUS COM>
Sent: Tuesday, January 30, 2001 9:48 PM
Subject: Wingate 1080/8080 Scans


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Did anyone other than myself notice a metric ton of WinGate scans the
> past two days for both 1080 and 8080?!?
> I would estimate that 80-90% of our customers experienced extremely
> high numbers of these scans yesterday and today.
>
> Anyone else notice this or am I just not lucky today?!?!
>
>
>
> Best Regards,
>
>
> Brian D. Taylor
> Level 2 Security Analyst
> SecureWorks/IMSC
> www.secureworks.net
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>
>
> iQA/AwUBOnenOwBthbPW+yLIEQKttwCgqthatztLVaN5I7iBp/22XpnJiGgAmwR0
> xNE0IhJgCPlvwzZLLlpl7W84
> =J1IO
> -----END PGP SIGNATURE-----