Re: CodeRed back with with a vengence this month!

[zeno <bugtraq () cgisecurity net>]

Hey,

> quickly this month after its sleep period.  In past months snort has 
> not seen CodeRed attacks until 9th or 10th, this month I started seeing 

I saw a couple log entries but they where from the 8th nothing on the day
you speak of. .


> jumped from about 800 unique source addresses per hour on Nov 30 to 
> nearly 3000 this morning.

damn if it helps I haven't seen this much traffic maybe a new worm version that
starts on 1.x.x.x and adds one? What subnet you on? I'm on 199.x.x.x and seen
almost nothing.

- zenomorph


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com