Port 80 traffic: Sources Increase

by Marianna Schmudlach - 12/8/03 8:43 AM

The number of sources which scan for port 80 have been increasing. Please take a look at your web logs to check for any unusual activity.

http://isc.sans.org/port_details.html?port=80

The number of sources scanning a specific port is usually a very sensitive indicator for new self propagating attacks. Given the significant background noise from older worms (Code Red, Nimda, Nachia), it is not easy to spot a new attack.

http://isc.sans.org/diary.html?date=2003-12-07