Security Incidents: Re: Aggresive RPC & DNS scans from Korean hosts

[dano <dano () PHINK ORG>]

On Mon, 19 Mar 2001, Joseph Nicholas Yarbrough wrote:

> In the spirit of owned korean hosts, a we have been getting aggresive scans
> from 203.232.4.4 on tcp/53 and tcp/111. (perhaps more)
>
> -Nick
We've been getting scanned by that same ip for port 53 since Saturday, avg
about one system every 15 mins.  Think it finally stopped an hour ago.

Last system scanned indicates that they hit ports 53, 111, 515, 3128.

--Dano