Is this anything to be concerned about? The only ports that i have open is for IMAP, POP3 and SMTP. I also publish a few sites. DNS1 is also a Zone transfer server. Is this a regular occurance??? ISA Server name: DNS1 ISA Server detected an all port scan attack from Internet Protocol (IP) address 196.25.1.1. For more information about this event, see ISA Server Help.