Agobot scanning...
Take a look at these links:
http://isc.sans.org/diary.php?date=2004-04-05
http://isc.sans.org/diary.php?date=2004-04-01
http://isc.sans.org/diary.php?date=2004-04-09
Also, take a read through the New Worm??? thread at:
--On Saturday, April 10, 2004 8:35 AM -0700 Christopher J. Wolff
[EMAIL PROTECTED] wrote:
Hello,
Over the last few days I've seen a number of hosts attempt to initiate TCP
connections to the following ports in sequence.
80
139
445
6129
3127
1025
135
2745
...repeat.
There's a number of
On 04/4/10 at 1:53 PM -0400, Jeff Workman wrote the following :
http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.um.htm
File Not Found... 'l' missing from end of 'htm'.
http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.um.html
On Sat, Apr 10, 2004 at 11:19:19AM -0700, Darrell Greenwood said at one point in time:
On 04/4/10 at 1:53 PM -0400, Jeff Workman wrote the following :
http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.um.htm
File Not Found... 'l' missing from end of 'htm'.
Laboratories, Inc.
http://www.bblabs.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
ravi pina
Sent: Saturday, April 10, 2004 11:30 AM
To: Darrell Greenwood
Cc: 'nanog list'
Subject: Re: worm information
On Sat, Apr 10, 2004 at 11:19:19AM -0700
PROTECTED] On Behalf Of
ravi pina
Sent: Saturday, April 10, 2004 11:30 AM
To: Darrell Greenwood
Cc: 'nanog list'
Subject: Re: worm information
On Sat, Apr 10, 2004 at 11:19:19AM -0700, Darrell Greenwood said at one
point in time:
On 04/4/10 at 1:53 PM -0400, Jeff Workman
To: Christopher J. Wolff
Cc: [EMAIL PROTECTED]; 'Darrell Greenwood'; 'nanog list'
Subject: Re: worm information
hmm, honestly i can't vouch for the data rate personally.
a co-worker said the counters on the VPN connections were
grossly disproportionate for a short time sample.
bottom line
