Internet Storm Center
Training
Certification
Cyber Security Graduate School
Security Awareness Training
Computer Forensics
Penetration Testing
IT Audit
Software Security
The "Trend" is an attempt to put a number to the increase in activity for a given port.
Right now, I am comparing the last 24 hours to the last 30 days.
So if we see a rise in activity compared to the last 30 days, the trend is high.
The following formula is used to calculate the trend:
sqrt( (S-s)^2/s + (T-t)^2/t ) )
S: number of source IPs hitting this port last 24 hrs.
s: average number of source IPs hitting this port each day (last 30 days).
T/t: same for target IPs detecting scans on this port.
| Port | Trend | Service |
|---|---|---|
| 707 | 1 | borland-dsj |
| 480 | 1 | iafdbase, loadsrv |
| 505 | 1 | mailbox-lm |
| 780 | 1 | wpgs |
| 321 | 1 | pip |
| 580 | 1 | sntp-heartbeat |
| 1020 | 1 | Vampire |
| 1010 | 1 | DolyTrojan, surf |
| 888 | 1 | accessbuilder, cddbp |
| 777 | 1 | AimSpy, jconfig, multiling-http, Undetected |
| 9797 | 1 | lcfd |
| 23432 | 1 | Asylum |
| 73 | 1 | netrjs-3 |
| 29005 | 1 | starsiege |
| 1011 | 1 | DolyTrojan |
| 9200 | 1 | wap-wsp |
| 666 | 1 | AttackFTP, BackConstruction, BLAtrojan, Cain&Abel, doom, lpdw0rm, mdqs, NokNok, SatansBackDoor, ServU, ShadowPhyre, th3r1pp3rz |
| 27005 | 1 | flex-lm |
| 43 | 1 | whois |
| 82 | 1 | xfer |
| 54321 | 1 | BackOrifice2000, SchoolBus |
| 444 | 1 | snpp |
| 9876 | 968 | CyberAttacker, Rux, sd |
| 7777 | 907 | cbt, FWTK-authsvr, GodMessage, oracle-portal, TheThing(modified), Tini |
| 5555 | 899 | personal-agent, rplay, ServeMe |
| 2 | 883 | compressnet, Death |
| 808 | 844 | WinHole |
| 2479 | 821 | ssm-els |
| 8443 | 794 | pcsync-ssl |
| 1061 | 754 | kiosk |
| 4321 | 745 | BoBo, rwhois |
| 2425 | 736 | fjitsuappmgr |
| 1051 | 734 | optima-vnet |
| 1052 | 723 | Apache, ddt |
| 1062 | 713 | veracity |
| 2222 | 698 | AMD, rockwell-csp2 |
| 8181 | 697 | biblioTECH, Erkez.D, http-alt, ipswitch, pix-devmng, Zafi.D |
| 1042 | 695 | BLAtrojan |
| 9100 | 694 | jetdirect |
| 995 | 692 | pop3s |
| 2301 | 689 | compaqdiag, cpq-wbem |
| 1040 | 658 | netarx |
| 993 | 617 | imaps |
| 1000 | 602 | cadlock2, Connecter, DerSpähe, DerSpherDerSpaeher, DirectConnection, InsaneNetwork |
| 8008 | 594 | http-alt, novell-http |
| 1032 | 501 | iad3 |
| 9000 | 464 | cslistener, Netministrator |
| 1031 | 454 | iad2, Xanadu |
| 7 | 443 | echo |
| 143 | 419 | imap |
| 1 | 408 | SocketsdesTroie, tcpmux |
| 7778 | 406 | interwise, UnReal_UT |
| 1234 | 403 | hotline, search-agent, SubSevenJavaclient, UltorsTrojan |
| 8888 | 389 | ddi-tcp-1, ddi-udp-1, sun-answerbook |
| 123 | 386 | NetController, ntp |
| 500 | 375 | isakmp |
| 5060 | 370 | sip |
| 6789 | 360 | ibm-db2-admin |
| 1111 | 351 | lmsocialserver |
| 110 | 349 | pop-3, ProMailtrojan |
| 6881 | 338 | bittorrent |
| 9090 | 311 | websm, zeus-admin |
| 6969 | 274 | 2000Cracks, acmsoda, Danton, GateCrasher, IRC3, NetController, Priority |
| 10000 | 252 | BackupExec, ndmp, OpwinTRojan |
| 3306 | 247 | mysql |
| 8778 | 235 | wn-http |
| 161 | 230 | snmp |
| 6588 | 228 | AnalogX |
| 21 | 223 | AudioGalaxy, BackConstruction, BladeRunner, CattivikFTPServer, CCInvader, DarkFTP, DolyTrojan, Fore, FreddyK, ftp, InvisibleFTP, Juggernaut42, Larva, MotIvFTP, NetAdministrator, Ramen, RTB666, SennaSpyFTPserver, Traitor21, WebEx, WinCrash, [trojan]TheFlu |
| 1080 | 198 | socks, SubSeven2.2, WinHole |
| 3128 | 195 | ReverseWWWTunnel, RingZero, squid-http |
| 8000 | 193 | irdmi |
| 8080 | 172 | BrownOrifice, Genericbackdoor, http-alt, RemoConChubo, ReverseWWWTunnel, RingZero |
| 1029 | 163 | ICQNuke98, InCommand |
| 81 | 154 | docs-to-go, hosts2-ns, RemoConChubo |
| 22 | 145 | Adoresshd, pcanywhere, Shaft, ssh |
| 4899 | 127 | radmin |
| 443 | 126 | https |
| 1024 | 125 | Jade, kdm, Latinus, NetSpy, RAT |
| 9898 | 121 | dabber, monkeycom |
| 5900 | 105 | vnc |
| 23 | 65 | ADMworm, FireHacKer, MyVeryOwntrojan, RTB666, telnet, TelnetPro, TinyTelnetServer, TruvaAtl |
| 1433 | 62 | ms-sql-s |
| 53 | 59 | ADMworm, domain, Lion |
| 25 | 46 | Ajan, Antigen, Barok, BSE, EmailPasswordSender, EPSII, Gip, Gris, Happy99, Hpteammail, Hybris, Iloveyou, Kuang2, MagicHorse, MBT, MBTMailBombingTrojan, MoscowEmailtrojan, Naebi, NewAptworm, ProMailtrojan, Shtirlitz, smtp, Stealth, Stukach, Tapiras, Terminator, WinPC, WinSpy |
| 139 | 39 | Chode, GodMessageworm, Msinit, netbios-ssn, Netlog, Network, Qaz, Sadmind, SMBRelay |
| 137 | 38 | Chode, Msinit, netbios-ns, Qaz |
| 1026 | 33 | nterm, win-rpc |
| 80 | 26 | 711trojan, 8085, AckCmd, BackEnd, BO2000Plug-Ins, Cafeini, CGIBackdoor, Executor, GodMessage, GodMessage4Creator, Hooker, http, IISworm, MTX, NCX, Noob, Ramen, ReverseWWWTunnel, RingZero, RTB666, Seeker, WANRemote, WebDownloader, WebServerCT, www |
| 135 | 25 | epmap, loc-srv |
| 445 | 17 | microsoft-ds |
| 6257 | 2.8 | WinMX |
| 3389 | 2.62 | ms-term-services |
| 6515 | 1.71 | game-play, McAfee-http |
