CR2 question

Sun Aug 26 01:58:22 UTC 2001

I'm actually seeing several thousand port 80 scans per hour !  

Code Red Log Checker 
Beginning Time... 
20:00:01 
Ending Time: 
21:00:00 
Number of attacks... 
    3137 
Number of unique addresses... 
     287 

-----Original Message-----
From: Todd Suiter
To: nanog at merit.edu
Sent: 8/25/01 4:34 PM
Subject: CR2 question

Folks,

	Its been almost a month, and my IDS is still picking up several
hundred CodeRed 2 attacks a day. Is anyone else seeing this same level
of continued
activity of this worm? I personally am somewhat at a loss as to how to
contact
people who are affected, as automated broadcasts to people, in my
opinion, are
NOT the way to go. BUT, going through several hundred IPs, a day, and
trying
to find someone at those organizations to speak to is A LOT of work. Any
ideas?

Thanks!

todd