doug at clickdoug.com
Tue May 18 13:53:59 UTC 2004
Now that we know it's Bobax scanning http://isc.sans.org/diary.php do we
know if the source IP's are legit or spoofed?
Our Anti-spam solution works!!
For hosting solutions http://www.clickdoug.com
----- Original Message -----
From: "Geo." <geoincidents at nls.net>
To: <nanog at merit.edu>
Sent: Tuesday, May 18, 2004 8:15 AM
Subject: Port 5000
: We are seeing many customers here probing port 5000 across the network. It
: appears to be some new worm or something but I've had no luck yet in
: figuring out what it is except to say norton AV detects nothing yet.
: Anyone have a clue?
: the jump in traffic is obvious.
More information about the NANOG