<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hi,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Noticed this afternoon a rise in scans on port 445
(microsoft-ds) on all the servers I look after (both at home and in a couple of
telehouses).</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Two were probed by the same host 80.139.54.195 but
it seems to also be coming from hosts on the same A class as I'm on
217.206.223.70 and 217.207.153.72 </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I read about a DOS attack on this port (sometime in
April 17th) but is it likely there is a worm using it as well?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Anyone else being probed and now if this is another
Microsoft special?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Cheers</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Andy</FONT></DIV>
<DIV><FONT face=Arial size=2>aka paranoid of Purley</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>