Worm probes

Tue Sep 18 18:17:37 UTC 2001

On Tue, Sep 18, 2001 at 10:46:03AM -0700, Ulf Zimmermann wrote:
> 
> On Tue, Sep 18, 2001 at 10:40:23AM -0400, Smith, Rick wrote:
> > 
> > 
> > For the past 2 weeks or so, we were averaging 1,200 probes per hour.
> > 
> > As of 8 or so this morning, we started averaging > 25,000 per hour!
> > 
> > I've noticed that at the same time, we started getting probes from our
> > provider's space (uniquely 23 addresses there), but not our own.  Until this
> > morning, we had *0* probes from inside our provider's space.
> > 
> > Maybe this is the next round kicking off, looking for things to infect
> > locally before searching the world again.
> 
> Simular here, most probes so far are coming from Speakeasy DSL IPs to
> my Speakeasy DSL servers. Haven't checked the others yet. So far
> about 20k probes.

	I think it scans your local /16

	I've seen other scans from the /16 that my machines reside in.

	- Jared

-- 
Jared Mauch  | pgp key available via finger from jared at puck.nether.net
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.