On Sunday 12 August 2001 09:57 pm, Ryan wrote:
> I believe you're in the 24.x subnet, as are most cable modem
> customers? I have checked by logs also, and it appears all of my
> hits are coming from same. I changed apache config a week or two ago
> to do NS lookups, so I have mostly @home or RoadRunner subs by the
> looks of it.
Yes, I am on the 24.X.X.X subnet, and the vast majority of all my hits
are from the same.
> I think perhaps Excite@Home is blocking incoming port 80 hits from
> the internet through their routers? I have 275 hits since 4am today
> (18 hours) and only three are outside of 24.x This could be checked
> of course, if one had the means to do so. Someone from Europe could
> try hitting my humble test webserver at http://endless.eu.org
>
> Just a theory.
I've read that many ISP's are doing the same thing. I know ATT
broadband is, as I just finished reading an article that mentioned it.
It appears to be helping somewhat. I've seen only about 100 hits since
4:00 AM, and only 3 of those were from outside the 24.X address space.
But, that's also a characteristic of Code Red II, it hits closer to
home. I forget the numbers involved, but it is _far_ more likely to
attack machines within it's own address block.
-D
_______________________________________________
Seawolf-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/seawolf-list
