 | View Full Version : port 6666 MilkMan 03-13-2002, 05:34 PM An IRC attack? Keep seeing referers in logs that look like: 209.116.7.23:6665 Also has 6666 and 6667 as the ports. As I recall those are IRC ports, any ideas? dside443 03-13-2002, 05:42 PM Maybe someone edited their IRC server's DNS (A) entry and made a typo. Accidentally pointed it to your IP instead of theirs. Result: lots of people trying to connect to theirs, but going to yours. clocker1996 03-14-2002, 05:15 AM you running iplog? could be src port are you running an ircd? MilkMan 03-14-2002, 10:43 AM Originally posted by clocker1996 you running iplog? could be src port are you running an ircd? Nope...just checked a few other sites and they are showing the same type of hits to those ports. Created a new web account with no real domain name and a day later the same 6666/6667's were coming up. Status was 405 stormtrooper 03-14-2002, 04:02 PM Are you (or your reseller) running Melange chat? It uses those ports. Alternately, do you (or your reseller) have portsentry running on the server? Portsentry will plug a port with it's big fat butt and stop other services from binding to those ports. bhalsted 03-15-2002, 07:02 AM Are there any 'strange' processes running on your box? |