[unisog] New Worm???

Peter Van Epp vanepp at sfu.ca
Tue Jan 18 00:01:50 GMT 2005


	I'm seeing a noticable shift in to 8x (83 and 84 seem very popular)
addresses for source of scans for 1025 but not particularly a volume increase 
(it was around 200k for 24 hours ending 06:00 this morning and around 70k from
06:00 til now so far today).

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

On Mon, Jan 17, 2005 at 06:00:32PM -0500, Gary Flynn wrote:
> 
> Our sensors started detecting a large increase in
> incoming scanning and exploit  attempts for
> WebDAV on port 80 and DCOM/RPC services
> on TCP port 1025 a little after 1400 EST.
> 
> Anyone else seen something similar?
> _______________________________________________
> unisog mailing list
> unisog at lists.sans.org
> http://www.dshield.org/mailman/listinfo/unisog



More information about the unisog mailing list