[nsp-sec] 9001: New UDP amplification port?

[Borja Marcos]

> On 1 Jul 2021, at 10:44, Borja Marcos <borjamar at sarenet.es> wrote:
> 
> No packets. As destinations have been random I don’t think it will be easy to catch some. I’ll check my darknets
> though.

Something seems to be going on with port 9001. There is a sudden interest on it, I have two /23 darknets and I see
an odd scan with udp/9100 as destination.


On Jun 14th, source address 80.82.76.6, more or less random source ports, One byte payload, just a 0. It didn’t
try any other destination port. 

The rest of the scans for port 9001 since May are just SIP requests. I am checking for the whole 2021 but it will take
a while (old kit struggling to keep up with all the work!).





Cheers,





Borja.