Starting 12-JUL-2018 the number of DShield participants reporting probes for %%port:15454%% started to rise. It popped up on the experimental trends report (https://isc.sans.edu/trends.html) yesterday. Fellow handler Richard Porter thought it sounded like a “debugger port for an App” and after a quick jaunt to The Googles he returned with an old report that this port opens up when the Clound9 IDE is doing its thing. (Source: https://stackoverflow.com/questions/39007572/cloud9-debugger-listening-on-port-15454)
Article Link: https://isc.sans.edu/diary/rss/23888