Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: InfoSec Handlers Diary Blog - Port 80 traffic: Sources Increase InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Port 80 traffic: Sources Increase

Published: 2003-12-07
Last Updated: 2003-12-07 21:56:08 UTC
by Handlers (Version: 1)
0 comment(s)
The number of sources which scan for port 80 have been increasing. Please take
a look at your web logs to check for any unusual activity.

http://isc.sans.org/port_details.html?port=80

The number of sources scanning a specific port is usually a very sensitive indicator for new self propagating attacks. Given the significant background
noise from older worms (Code Red, Nimda, Nachia), it is not easy to spot a new
attack.
Keywords:
0 comment(s)
Diary Archives