boomer

Anyone else getting large number of hack attempts on port 445?

For the last few weeks i have been getting loads of incomings (blocked by my firewall). Apart from the normal background noise of HTTP, HTTPS and SMTP scans, this seems to be the choice du-multi-jour for the saddo-phreaks

The source addresses vary (24.61.128.211 a few minutes ago to 61.*, 212.*, 66.* etc.) so it probably isn't just a Demon problem

They are like the bluebottles and wasps that get in your face when having a pint on a hot summers day. Harmlesss, but irritating [img]images/smilies/mad.gif[/img]

mb

bashful

/etc/services has that port down as 'microsoft-ds'. Would it be too arrogant and world-weary to note that that says it all?

JackClark

http://vil.nai.com/vil/content/v_100127.htm

elgordano

Check out DShield. It might give you some more information.

Gordo

boomer

elgordano,

that DShield link was quite interesting - especially the breakdowns of port hacks by country!

Cheers,

mb