Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Port 2222 (tcp/udp) Attack Activity - SANS Internet Storm Center Port 2222 (tcp/udp) Attack Activity


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Loading...
[get complete service list]
Top of page
Port Information
Protocol Service Name
tcp AMD [trojan] Rootshell left by AMD exploit
tcp rockwell-csp2 Rockwell CSP2
udp rockwell-csp2 Rockwell CSP2
UDP [ICS] Ethernet/IP [ICS] Ethernet/IP
Top IPs Scanning
TodayYesterday
142.93.214.96 (8042)61.130.28.203 (34255)
61.130.28.203 (5242)142.93.214.96 (16884)
61.177.173.2 (3939)61.177.173.2 (6053)
121.169.34.172 (2219)179.43.154.138 (1742)
129.205.102.242 (1319)121.40.238.6 (1356)
203.76.150.130 (1152)163.123.142.156 (840)
179.43.154.138 (1004)47.242.36.213 (805)
210.245.119.111 (899)182.92.198.113 (656)
61.177.172.139 (816)87.249.50.69 (599)
202.40.190.10 (554)136.144.41.248 (493)
Port diary mentions
URL
2222tcp Probe Increase
Top of page
User Comments
Submitted By Date
Comment
Johannes Ullrich 2020-09-16 13:54:15
Port 2222/udp is used by the Ethernet Industrial Protocol (Ethernet IP) which is used by industrial control systems (ICS)
Johannes Ullrich 2020-09-13 14:35:33
Schneider Modicum Quantum uses port 4418/TCP in addition to 502/TCP (MODBUS) and 2222/UDP (Ethernet Industrial Protocol). CVEs: CVE-2019-6815, CVE-2019-6816
2004-09-09 06:58:57
Microsoft Office under Apple Macintosh OS-X broadcasts (255.255.255.255) UDP to port 2222, supposedly to check if anyone else is using the same version? s/n? of Office.
2004-07-01 16:26:45
Looks like Macs use this port for networking.
Add a comment
Top of page
CVE Links
CVE # Description
CVE-2007-0655 The MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan 8.0.671.1, and possibly other versions, allows remote or local attackers to gain privileges and execute arbitrary commands by connecting directly to TCP port 2222.
CVE-2018-18388
Top of page