Worm probes

Tue Sep 18 14:25:51 UTC 2001

At 09:54 AM 9/18/01, sigma at pair.com wrote:

>Has anyone else been seeing a dramatic increase in /scripts/.. NT worm
>probes this morning?  We're seeing about 8000/second, starting around 9:15
>Eastern time, to and from a wide variety of addresses.
>
>Is CodeRed or one of its relatives scheduled to start sweeping again today?
>We've never seen this level of traffic related to the NT worms.  Even
>though we don't run any NT at all, we still have to suffer :(

First ones appeared today, and so far I see 17650 attempts on just one of 
my servers. We don't run any Microsoft stuff either, but that doesn't keep 
our servers from getting hammered...
-----------------------------------------------------------------
Daniel Senie                                        dts at senie.com
Amaranth Networks Inc.                    http://www.amaranth.com