Getting port scan on 4899

[Law]

Sep 05, 2005 01:34:18.343 UTC - 218.186.33.181 : 2394 >>> 68.*.*.* : 4899 - Remote Administrator
Sep 08, 2005 22:00:17.328 UTC - 200.88.240.219 : 4585 >>> 68.*.*.* : 4899 - Remote Administrator
Sep 08, 2005 22:00:08.328 UTC - 200.88.240.219 : 4585 >>> 68.*.*.* : 4899 - Remote Administrator

Been getting these constant scan on port 4899 which I know is remote administration port for the RADMIN software. Was just wondering if anyone had these or am I the only target here. Those IP address 218.....to 200 are all allocated to the Latin American and Caribbean IP address Regional Registry.

 

[Obtruse_Man4]

I don't check my logs.... I should.... I might check them once a year....

*goes to check logs*

 

[Law]

Was looking at the log again, and found some info that indicated it was a login attempt and port scan. Also definitely someone behind a proxy.

 

[office politics]

sure its a scan and not a brute force cracker?

 

[Obtruse_Man4]

Out of curiosity, why use RADMIN when you have remote connection in windows?

 

[Law]

I don't use it...neither do I use windows remote login

I think my ip address was probably once given to somebody with a server using RADMIN and the remote machine might be an autobot. Probably why it keeps occuring with no login success.

I have numerous report..same ip range and happens everyday about 4 times on average.

 

[DJ-CHRIS]

I have never had attempt's on that port before...

However a few weeks ago, I kept having these attack's on this port that in not in use for anything. It was pretty damned consistant too.

Too bad my router with logging is dooooown