Port 80 Scan Galore!

DIDS · Post by **DIDS** » Sat Aug 04, 2001 12:55 pm

I am getting hit like crazy with Port 80 scans. Most likely due to the Code Red Worm. They are all primarily on RoadRunner. Anyone esle getting nailed alot by these scans?

W_I_Z_K_I_D · Post by **W_I_Z_K_I_D** » Sat Aug 04, 2001 2:06 pm

Yo listen Dids
i aint got no port 80 scans latelly but yeah your right...probbaly got somethin to do with code red..
Kepp my ears and eyes open bro....You might whanto check with Greed and see what port 80 is and what its used for...he has an interesting port list.....could be uselfull
lAyTa

greEd · Post by **greEd** » Sat Aug 04, 2001 3:01 pm

port 80 is http

Logan 5 · Post by **Logan 5** » Sat Aug 04, 2001 4:21 pm

DIDS,

Yes I am getting hit on port 80 big time. Using ZoneLog Analyser
and it is showing them from all over the place.

Jim

Dakota · Post by **Dakota** » Sat Aug 04, 2001 8:17 pm

Nothing's getting past my router to ZAPro, but my modem lights (data and activity) are blinking just like I'm downloading a file. Been doing that all day today, but no data is coming through, and nothing to my computers except what's supposed to come through. Speed is also unaffected as I get 500—1,000-plus KB/ps at HappyPuppy. I called ATT and they have no idea what's going on either, but they have been getting a bunch of complaints on it today and they are trying to find out what's up.

fredra · Post by **fredra** » Sat Aug 04, 2001 8:34 pm

Same here with the Port 80 scans....my router is not letting them through, but my logs are filling up and speed is adversely affected....
And it is constant...OMG...it NEVER stops....
I will have to just shut the sucker down and go watch TV
PEACE!!!!!

Dakota · Post by **Dakota** » Sat Aug 04, 2001 11:58 pm

Weird. My speed is not effected at all as I said above...

blebs · Post by **blebs** » Sun Aug 05, 2001 12:07 am

I think this is the full scale attack! I've got one sub 7 hit and the entire log is filled with port 80 hits. I can't clear the alert fast enough!

MrTRiX · Post by **MrTRiX** » Sun Aug 05, 2001 4:30 am

I am trying to make a TPF rule so I can see them all?

Is it Port 80 on TCP Incoming? And should I set it to watch Local port 80 or remote port 80?

blebs · Post by **blebs** » Sun Aug 05, 2001 6:50 am

port 80 TCP incoming and I believe local. might try it both ways though.

Zporttech · Post by **Zporttech** » Sun Aug 05, 2001 10:22 am

My port 80 has also been under attack. About 200 hits yesterday (8/4).

Using @Home in Indiana.............

Zuma · Post by **Zuma** » Sun Aug 05, 2001 12:27 pm

My modem is still going nuts, but nothing is getting past the router to Tiny. Unlike BlueJetta tho my speed is horrible (40KBs at HappyPuppy) ACK!

BadEditor · Post by **BadEditor** » Sun Aug 05, 2001 12:31 pm

I'm getting 'probed' alot too

Starting saturday around 11am is when I started to Notice it....

My Zonealarm is Logging around 350 port scans from Various IP addresses.....

Called Tech and They know about it....

boobless · Post by **boobless** » Sun Aug 05, 2001 3:39 pm

same here....got close to 500 port 80 scans since yesterday. am on cox@home in RI.

@guard's not letting em through tho. most of them seem to be comming from up north...in or near canada.

chimdogger · Post by **chimdogger** » Sun Aug 05, 2001 7:00 pm

The Chimdogger checking in....
My modem is possesed. Get me a preist! Port 80 scans up the buTT. Couple sub7 scans for good measure. Dont know what the deal is but I am considering a cable router. What could they be scanning for on port 80. Everybodys computer is wide open on port 80 but what are they hitting it for???? If there is an exploit for port 80 then things are going to get real interesting...

Later on,

Chimdogger out

Juggernaut · Post by **Juggernaut** » Sun Aug 05, 2001 7:10 pm

Originally posted by boobless
most of them seem to be comming from up north...in or near canada.

It's all a plan for us Canucks to take over

cyberskye · Post by **cyberskye** » Mon Aug 06, 2001 6:11 pm

Code Red proliferates by scanning for other unpatched IIS servers. Most often these servers would be listening on tcp port 80 (http)...

I received over 500 requests yesterday - I'm on comcast@home, alexandria VA.

Most of them are coming from other hosts on the @home network all over canada and some from new england.

Speeds are down from 2400-3200 Down to about 1000. And I thought @home said they were going to start blocking inbound requests on port 80 across their network...

Skye

fredra · Post by **fredra** » Mon Aug 06, 2001 10:17 pm

From Canada eh
We are taking over...watch out...lol
PEACE!!!!

SG Broadband Community

Port 80 Scan Galore!

Port 80 Scan Galore!

Same Story different modem in Florida on RR