[Dshield] increase in port 445 scanning

Jeff Kell jeff-kell at utc.edu
Mon Jan 12 20:59:20 GMT 2004


Hudak, Tyler wrote:

> Over the last two hours my IDS' have picked up a massive increase in port
> 445 scans coming from Europe and Asia.  I don't see anything on DShield yet
> about it, is anyone else seeing something similar?  Differing window sizes
> and IPIDs on each packet, so I don't think they are forged from the same
> machine and spoofed.  New worm perhaps?  One of the new AGOBOT worms?

So far today, my top 8 ports are:

>Port   139	1433	135	4444	445	6129	80	4000
>Count  58374	53823	50498	33287	30639	9196	6182	3026






More information about the list mailing list