Last Updated: 2017-04-23 13:35:40 UTC
by Jim Clausing (Version: 1)
I don't know what of our tools you, our readers, use on a regular basis, but one of the things, I like to look at first when I login to isc.sans.edu is the Top 10 Ports by Unique Sources chart. This suggests coordinated (think botnets) scanning. So, I was really shocked to see port 81 had jumped up to 2nd position just behind all the Mirai-ish port 23 scanning. Take a look at the port 81 chart. If any of our readers have any insight into what is going on here since 16 Apr, plase let us know.
Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu