[Intrusions] DDoS attack on mpecllc.com update

[David McCall]

   wc -l untrusted                                        
   51170 unique IP addresses attacking the site as of 4pm  PST.


Here's an interesting link:


http://www.broadbandreports.com/forum/remark,12309722~mode=flat

I'm liking the fact that our domain appears right in the middle of the pack....
Now I don't feel so all alone.

And what's more interesting is that this worm (is it?) installs itself as a MSIE plugin.

I also have some information that there is a search ongoing for the botnet C&C, I don't 
exactly know what this means, but I assume it has something to do with the worm controller?

more to come.

David C.McCall
UNIX Administrator
===================
EschelonTelecom
admin at atgi.net
david at atgi.net