[45712] in North American Network Operators' Group
RE: port 139 scans?
daemon@ATHENA.MIT.EDU (Steve Smith)
Wed Feb 13 10:12:58 2002
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Wed, 13 Feb 2002 09:03:11 -0600
Message-ID: <FBCFA6583C88244DB2B9CA2D5494B512547A5B@MEMMAILCLUSTER1.se.freeliant.net>
From: "Steve Smith" <ssmith@freeliant.com>
To: "Jasper Wallace" <jasper@ivision.co.uk>, <nanog@merit.edu>
Errors-To: owner-nanog-outgoing@merit.edu
There is a new trojan called ANTZ that scans this port. We have seen a
ton of these.
-----Original Message-----
From: Jasper Wallace [mailto:jasper@ivision.co.uk]
Sent: Wednesday, February 13, 2002 5:38 AM
To: nanog@merit.edu
Subject: port 139 scans?
Is anyone else seing lots of packets being thrown at port 139?
We're getting 5 or 6 packets a sec, mostly from 80.0.0.0/8 (and all tcp
syn's).
--=20
Internet Vision Internet Consultancy Tel: 020 7589
4500
60 Albert Court & Web development Fax: 020 7589
4522
Prince Consort Road
vision@ivision.co.uk
London SW7 2BE
http://www.ivision.co.uk/
