Port Scan Attack

Discussion in 'ESET NOD32 Antivirus' started by EvilDave UK, Nov 3, 2010.

Thread Status:
Not open for further replies.
  1. EvilDave UK

    EvilDave UK Registered Member

    Joined:
    Dec 20, 2005
    Posts:
    275
    Location:
    United Kingdom
    One of my Linux servers was port scanned last night a dozen times in just a few seconds, in-between 23:00 and 00:00 GMT. The IPs originated from different parts of the world. I noticed how a single host would try to port scan a few times, then another host would try. But there would never be more than 1 host port scanning at the same time.

    Does this sound like the behaviour of a virus/trojan or more like someone controlling a botnet?
     
  2. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,032
    Location:
    California
    Hello,

    It sounds more like a botnet attempting to do a distributed login attempt, but it could be either.

    Regards,

    Aryeh Goretsky
     
Thread Status:
Not open for further replies.