Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Port 4000 (tcp/udp) Attack Activity - Internet Security | DShield Port 4000 (tcp/udp) Attack Activity


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Loading...
[get complete service list]
Port Information
Protocol Service Name
tcp Connect-BackBackdoor [trojan] Connect-Back Backdoor
tcp SkyDance [trojan] SkyDance
tcp terabase Terabase
udp terabase Terabase
udp icq ICQ pre-2000a
UDP [ICS] ROC PLus [ICS] ROC PLus
TCP [ICS] ROC PLus [ICS] ROC PLus
UDP [ICS] Emerson/Fisher ROC Plus [ICS] Emerson/Fisher ROC Plus
TCP [ICS] Emerson/Fisher ROC Plus [ICS] Emerson/Fisher ROC Plus
Top IPs Scanning
TodayYesterday
23.95.56.162 (1736)23.95.56.162 (3676)
5.188.206.18 (1129)104.143.83.242 (463)
185.176.27.110 (112)185.153.196.28 (283)
92.119.160.80 (66)88.214.26.45 (265)
198.108.67.48 (36)62.173.139.128 (256)
80.82.77.139 (22)92.119.160.80 (244)
120.52.152.17 (15)185.254.122.32 (206)
80.82.77.33 (14)77.247.110.217 (149)
185.176.27.42 (14)185.137.233.123 (120)
185.142.236.35 (11)198.108.67.48 (93)
User Comments
Submitted By Date
Comment
TP 2013-02-21 01:52:21
TCP 4000 also used by ThinPrint
Peter 2010-10-27 18:36:41
Is used also by Ericom WebConnect
2009-10-04 18:45:22
Looks like Trojan.Peacomm/Small.DAM, the "Video" trojan spammed recently, uses port UDP/4000 to communicate with a kind of peer-to-peer protocol.
Thomas Aalborgen 2006-12-22 13:59:24
There are some piece of software which is being used by travel agents to connect against Worldspan gateway websites (ticket booking purpose), which is not working if TCP/UDP 4000 is filtered. www.worldspan.com Best Regards, Thomas Aalborgen Taide Network AS Security Manager
Chris Miller 2006-05-30 17:31:40
Warp Pipe http://cubeonline.warppipe.com/support/router_firewall_support.html
DG 2004-08-11 02:27:40
Abacast streaming music client. http://support.abacast.com/index.php?x=&mod_id=2&id=29
Trafton 2004-03-21 00:53:32
W32/Witty.worm (Saturday, March 20th, 2004) http://www.sarc.com/avcenter/venc/data/w32.witty.worm.html
2003-07-16 02:25:17
Remomote Anything trial version.
Add a comment
CVE Links
CVE # Description