PortPeeker TCP Port 3410 Captures

Most of the scans we have seen on TCP Port 3410 are connection attempts to the OptixPro trojan so they appear in PortPeeker as typical Client/Server connection attempt where the scanning system connects to the port and waits for a response in the form of a login from the trojan.  If the response doesn't occur the scanning system breaks the connection and continues to scan.

TCP Connection Request 
--- 19/01/2004 03:11:51.674

61.36.209.92 : 2442 TCP Connected ID = 10
--- 19/01/2004 03:11:51.724
Status Code: 0 OK

61.36.209.92 : 2442 TCP Disconnected ID = 10
--- 19/01/2004 03:11:52.465
Status Code: 28160 [28160] (no description available)

We have seen some connection attempts where the connecting system has sent data as an attempt to initiate the connection.

TCP Connection Request
--- 19/01/2004 02:26:29.089

64.231.152.112 : 62289 TCP Connected ID = 9
--- 19/01/2004 02:26:29.210
Status Code: 0 OK

64.231.152.112 : 62289 TCP Data In Length 11 bytes : MD5 = 6AA92D058865A78659A23D63D700E08E
--- 19/01/2004 02:26:29.380
0000 30 32 32 AC AC 76 31 2E 32 0D 0A 022..v1.2..

Typically we see this connection pattern repeated from limited number of IP Addresses over a period of a couple days.

Page last updated on February 09, 2004