Antw: [Dshield] NetBIOS port probes up

Mike Burns mike.burns at
Fri Jul 19 21:50:34 GMT 2002

According to the emails in this group and other reports the increase in TCP
port 139 scans started on July 10th.  

The majority of the scans on TCP 139 that I see are coming from Taiwan and
Korea.  Only one IP address is scanned at a time and it is scanned 4 times
in a row from the same source.  No Ip address is scanned twice from
different sources.  It looks like a coordinated attack with a central
database somewhere of IP addresses or a predetermined list of addresses to

Basically it seems there is a slow, efficient, methodical scan of the entire
Internet on TCP port 139. 

Mike Burns
net-linx Publishing Solutions
icq# 39636054

-------------- next part --------------
An HTML attachment was scrubbed...

More information about the list mailing list