[Dshield] increase in port 445 scanning

Hudak, Tyler Tyler.Hudak at roadway.com
Mon Jan 12 14:55:32 GMT 2004


Over the last two hours my IDS' have picked up a massive increase in port
445 scans coming from Europe and Asia.  I don't see anything on DShield yet
about it, is anyone else seeing something similar?  Differing window sizes
and IPIDs on each packet, so I don't think they are forged from the same
machine and spoofed.  New worm perhaps?  One of the new AGOBOT worms?

Tyler



More information about the list mailing list