Re: new/old port 135 scans?

[Mike Hoskins <mike () adept org>]

Brian Collins wrote:
> Tonight we're seeing a significant increase in scans on tcp/135.  
> Customers are sending roughly 20 packets to several incremental IPs in a 
> class C, waiting 2 seconds, sending roughly 20 more, etc.  I was under 
> the impression that Blaster/Nachi was programmed to cease as of 1/1/04 
> (of course, I could be wrong about that).    I'll try to have some 
> packets available in a little while.  In the meantime, has anyone else 
> noticed an increase?

fwiw, i do still see 13x scans coming into most of my subnets...  many 
of these have proven to be (often very) slightly evolved variants, 
although i haven't yet done any real analysis in '04.


---------------------------------------------------------------------------
----------------------------------------------------------------------------