Re: Worm probes

[Jared Mauch <jared () puck Nether net>]

On Tue, Sep 18, 2001 at 10:46:03AM -0700, Ulf Zimmermann wrote:
> On Tue, Sep 18, 2001 at 10:40:23AM -0400, Smith, Rick wrote:
> > For the past 2 weeks or so, we were averaging 1,200 probes per hour.
> >
> > As of 8 or so this morning, we started averaging > 25,000 per hour!
> >
> > I've noticed that at the same time, we started getting probes from our
> > provider's space (uniquely 23 addresses there), but not our own.  Until this
> > morning, we had *0* probes from inside our provider's space.
> >
> > Maybe this is the next round kicking off, looking for things to infect
> > locally before searching the world again.
>
> Simular here, most probes so far are coming from Speakeasy DSL IPs to
> my Speakeasy DSL servers. Haven't checked the others yet. So far
> about 20k probes.

        I think it scans your local /16

        I've seen other scans from the /16 that my machines reside in.

        - Jared

-- 
Jared Mauch  | pgp key available via finger from jared () puck nether net
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.