Threat Level: green Handler on Duty: Jan Kopriva

SANS ISC: DShield Data Analysis: Taking a Look at Port 45740 Activity SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
DShield Data Analysis: Taking a Look at Port 45740 Activity

At the SANS Internet Storm Center (ISC), handlers frequently analyze data submitted from DShield participants to determine activity trends and potential attacks. A few days ago on May 31st, I observed a small anomaly for port 45740 and decided to monitor it for the next 3 days or so. There was a huge spike in number of sources/day and reports/day recorded on May 31st as shown in Figure 1.

Figure 1: Port 45740 Activity (Taken June 1, 2021)

I did not receive any probes on this port on my sensors, but after digging into the DShield data, it was observed that the reported traffic to port 45740 were sent via UDP.

Over the next few days (till June 3, 2021), the number of sources/day and reports/day have dropped drastically as compared to May 31 (with reference to Figure 2). A check on Censys and Shodan did not yield any interesting findings, although there were some mentions of Distributed Hash Table (DHT) along with some IP addresses and port 45740 as a pair.

Figure 2: Port 45740 Activity (Taken June 3, 2021)

If anyone has any insights or information that could help shed light on this phenomenon, please comment down below, contact us via our contact page or e-mail us.

-----------
Yee Ching Tok, ISC Handler
Personal Site
Twitter

Yee Ching

11 Posts
ISC Handler
Jun 3rd 2021

Sign Up for Free or Log In to start participating in the conversation!