I've seen nothing on this, nor do I have anything in our baseline. Next, yesterday I sent a response to an e-mail regarding the targeting of port 1114. We had several responses. One analyst reported after inspection of his logs, it appeared this port started showing up in August. This seems to have taken place once a month since August.
All reports seem to center around the second and fourth week of the month.
Submitted regarding a personal experience regarding Dynamic DNS updates . That is a rather frightening thought if I do say so myself. We discovered this problem accidentally here on campus and because this came up right before y2k, I totally forgot about it. In looking through my log files one day I discovered a known IP address trying to change the DNS, and later the same person with known IP from his house was trying to change the DNS for his home machine. Only then did I make the connection with that little checked option.