[Dshield] Please help

Cory.Bys@fbol.com Cory.Bys at fbol.com
Tue Oct 30 13:54:13 GMT 2001




<snip>For the past 2 weeks  it seems that I've been 'under attack' by
users from my own  ISP.
In the last 7 days  alone, I have been targeted 500+ times by
24.202.X.X.</snip>

I am seeing a lot of the port 80 stuff from DSL subscribers that are
infected with Nimda. See if the attackers are trying to do directory
transversals or GET requests for cmd.exe to confirm you are having the same
issue.

I have contacted AT&T and they don't seem to care either.

(Embedded image moved to file: pic05705.pcx)
(See attached file: pic05705.pcx)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pic05705.pcx
Type: application/octet-stream
Size: 33646 bytes
Desc: not available
Url : http://www.dshield.org/pipermail/list/attachments/20011030/4b0eea0d/iso-8859-1Qpic05705.obj


More information about the list mailing list