Re: Worm probes

[Daniel Senie <dts () senie com>]

At 09:54 AM 9/18/01, sigma () pair com wrote:


> Has anyone else been seeing a dramatic increase in /scripts/.. NT worm
> probes this morning?  We're seeing about 8000/second, starting around 9:15
> Eastern time, to and from a wide variety of addresses.
>
> Is CodeRed or one of its relatives scheduled to start sweeping again today?
> We've never seen this level of traffic related to the NT worms.  Even
> though we don't run any NT at all, we still have to suffer :(

First ones appeared today, and so far I see 17650 attempts on just one of 
my servers. We don't run any Microsoft stuff either, but that doesn't keep 
our servers from getting hammered...
-----------------------------------------------------------------
Daniel Senie                                        dts () senie com
Amaranth Networks Inc.                    http://www.amaranth.com