Re: Scans are way up, attacks are down??

["lsi" <stuart () cyberdelix net>]

John, 

What I noticed is that as the SoBig virus went up, the number of spams I received went down. 

See chart here: http://cyberdelix.net/media/spamtrak.gif

The lowest dip is August 15, 3 days before Sobig. 

Does this mean BOFH's stop spamming because they are configuring their viruses??? 

> Is anyone seeing a similar trend, or is it just me? 

I heard rumours about Sobig being a spammer-friendly virus.  The chart seems to support this. 

A few more Sobig comments are here: 
http://cyberdelix.net/opinions/damages2.htm

Stuart

On 26 Aug 2003 at 9:29, John C. Silvia wrote:

From:                   "John C. Silvia" <john () cadamier com>
To:                     <honeypots () securityfocus com>
Subject:                Scans are way up, attacks are down??
Date sent:              Tue, 26 Aug 2003 09:29:06 -0700

> I was going over my stats recently and noticed an interesting trend since
> these all of these worms hit.  It appears that scan's are way up (not
> surprising considering how blaster.d spreads itself), but attacks appear to
> be down a bit as well.
>
> The PDF attached shows scans and attacks (tcp connection attempts after
> being baited) against the networks I protect, from 8/1 - 8/25.  This pdf was
> generated from a network of ActiveScouts, FYI.
>
> Is this trend normal after a massive outbreak?
>
> Does this mean BOFH's stop hacking then they're infected??
>
> Is anyone seeing a similar trend, or is it just me?
>
> Cheers.


-- 
Stuart Udall
stuart () cyberdelix net - http://www.cyberdelix.net/
..revolution through evolution

want to make some cash? check out http://cyberdelix.net/affiliates.htm