Internet Storm Center
Training
Certification
Cyber Security Graduate School
Security Awareness Training
Computer Forensics
Penetration Testing
IT Audit
Software Security
The "Trend" is an attempt to put a number to the increase in activity for a given port.
Right now, I am comparing the last 24 hours to the last 30 days.
So if we see a rise in activity compared to the last 30 days, the trend is high.
The following formula is used to calculate the trend:
sqrt( (S-s)^2/s + (T-t)^2/t ) )
S: number of source IPs hitting this port last 24 hrs.
s: average number of source IPs hitting this port each day (last 30 days).
T/t: same for target IPs detecting scans on this port.
| Port | Trend | Service |
|---|---|---|
| 174 | 1 | mailq |
| 265 | 1 | x-bone-ctl |
| 10005 | 1 | OpwinTRojan, stel |
| 63 | 1 | via-ftp, whois++ |
| 454 | 1 | contentserver |
| 71 | 1 | netrjs-1 |
| 62 | 1 | acas |
| 888 | 1 | accessbuilder, cddbp |
| 512 | 1 | biff, comsat, exec |
| 427 | 1 | svrloc |
| 218 | 1 | mpp |
| 5021 | 1 | zenginkyo-2 |
| 5631 | 1 | pcanywheredata |
| 2769 | 1 | singlept-mvs |
| 7009 | 1 | afs3-rmtsys |
| 5200 | 1 | targus-getdata |
| 2529 | 1 | utsftp |
| 2822 | 1 | ka0wuc |
| 2864 | 1 | astromed-main |
| 666 | 1 | AttackFTP, BackConstruction, BLAtrojan, Cain&Abel, doom, lpdw0rm, mdqs, NokNok, SatansBackDoor, ServU, ShadowPhyre, th3r1pp3rz |
| 3319 | 1 | sdt-lmd |
| 2505 | 1 | torque-traffic |
| 3985 | 1 | mapper-mapethd |
| 3457 | 1 | vat-control |
| 43 | 1 | whois |
| 2546 | 1 | vytalvaultbrtp |
| 3201 | 1 | cpq-tasksmart |
| 2089 | 1 | sep |
| 69 | 1 | BackGate, tftp |
| 2784 | 1 | www-dev |
| 5 | 1 | rje |
| 2064 | 1 | distrib-netassholes, icg-iprelay |
| 3001 | 1 | nessusd, redwood-broker |
| 2152 | 1 | gtp-user |
| 2106 | 1 | ekshell, mzap |
| 82 | 1 | xfer |
| 20001 | 1 | Insect, Millenium, Millenium(Lm) |
| 2232 | 1 | ivs-video |
| 2201 | 1 | ats |
| 54321 | 1 | BackOrifice2000, SchoolBus |
| 2220 | 1 | netiq |
| 2565 | 1 | coord-svr, Striker, Strikertrojan |
| 222 | 1 | rsh-spx |
| 2120 | 1 | kauth, qencp |
| 6668 | 1 | irc, ircu |
| 5902 | 1 | vnc-2 |
| 4224 | 985 | vrml-multi-use |
| 8082 | 982 | blackice |
| 2042 | 978 | isis |
| 3049 | 976 | cfs, nsws |
| 2033 | 976 | glogger |
| 8880 | 973 | cddbp-alt |
| 2027 | 970 | shadowserver |
| 2023 | 969 | Ripper, RipperPro, xinuexpansion3 |
| 6883 | 968 | DeltaSourceDarkStar |
| 2044 | 965 | rimsl |
| 2011 | 964 | raid-cc, servserv |
| 2018 | 962 | rellpack, terminaldb |
| 2080 | 962 | autodesk-nlm, WinHole |
| 524 | 956 | ncp |
| 2022 | 955 | down, xinuexpansion2 |
| 2021 | 951 | servexec, xinuexpansion1 |
| 1925 | 950 | discovery-port |
| 24 | 948 | BO2KControlPort, priv-mail |
| 2012 | 945 | raid-ac, ttyinfo |
| 1885 | 943 | vrtstrapserver |
| 1961 | 941 | bts-appserver |
| 3080 | 939 | stm_pproc |
| 1940 | 939 | jvclient |
| 2047 | 936 | dls |
| 1908 | 935 | dawn |
| 1992 | 935 | ipsendmsg, stun-p3 |
| 1861 | 934 | lecroy-vicp |
| 1989 | 930 | mshnet, tr-rsrb-p3 |
| 1657 | 929 | fujitsu-mmpdc |
| 4590 | 928 | ICQTrojan |
| 1963 | 928 | webmachine |
| 1599 | 927 | simbaservices |
| 5305 | 925 | hacl-test |
| 2009 | 924 | news, whosockami |
| 1736 | 922 | street-stream |
| 2200 | 921 | ici |
| 1749 | 920 | aspen-services |
| 1762 | 920 | cft-1, sms |
| 1622 | 919 | ontime |
| 1527 | 918 | tlisrv |
| 1621 | 916 | softdataphone |
| 1596 | 915 | radio-bc, radio-sm |
| 1633 | 915 | pammrpc |
| 1768 | 915 | cft-7 |
| 1577 | 914 | hypercube-lm |
| 7777 | 913 | cbt, FWTK-authsvr, GodMessage, oracle-portal, TheThing(modified), Tini |
| 1529 | 912 | coauthor, support |
| 1827 | 911 | asi, pcm |
| 1654 | 911 | stargatealerts |
| 1580 | 910 | tn-tl-r1, tn-tl-r2 |
| 1997 | 909 | gdp-port |
| 1523 | 909 | cichild-lm |
| 1650 | 908 | nkd |
| 1561 | 908 | facilityview |
