Firewall Blocking (Score 1)

I forgot to mention that those port scans for ms-sql-s first started heavily occurring last wednesday. I guess (they) were busy trying to find SQL Servers out there before the weekend's attack. Also, in the past several months we've had heavy port scans from Asia originations, as specified above with all the C Classes. Keep an eye on the LACNIC (Latin America Networks) as there seems to be a slight ramp up of junk from there, such as 200.x.x.x Also the European Union like Romania 209.239.64.0 Lot's of work to do from the firewall perspective.