update on scans of tcp 12345 AUSCERT#36349

[r.fulton () AUCKLAND AC NZ (Russell Fulton)]

Greetings,
          I have now seen over 180 of these scans! 60 in the last 24
hours. One thing I have established since my last post is that these do
seem to be targetted at us.  I have not had anyone else contact me to
say that they have seen these and I contacted the network admin of one
of the neighbouring class Bs (another NZ university -- we got our
addresses at the same time) and they have not seen any of these scans.
Whether the targeting is deliberate of not is anyones guess.

Oh, yes.  Source addresses seem to be mostly dialup or cable/dsl
address and are spread around the world.

APNIC addresses (210.0.0.0/7) are over represented -- between third and
a half. Those that I looked up were predominantly Korean with a few in
Japan. There are quite a lot form home.com, sympatico.ca,
videotron.net, da.uu.net (cable providers?), and a smattering from
around the rest of the world including Europe.

The /24s on our net that are probed appear random with some being
probed more that once.

Cheers, Russell.