Security Incidents mailing list archives

1953 & 1808


From: godel () TECHNOLOGIST COM (godel () TECHNOLOGIST COM)
Date: Thu, 3 Feb 2000 13:59:04 -0000


I have been receiving very slow, widely spaced attempts to 
ports 1808 and 1953 on two different networks for the past 
week, both NT but not in the same netblock or even class.   
The scans - 4 or 5 a day, separated by 5-6 hours, were 
initially from an IP calling itself 'office.portal.ru', 
which indicated it was located in the corporate headquarters 
of a large, active commercial ISP in Russia.  Last night the 
same attempts apparently from a university, also in Russia.  

1808/tcp is listed as Oracle-VP2 but 1953 is unassigned.  

Has anyone received anything like this also, and any idea 
what they are hoping for?  Thanks for response!

Missy


Current thread: