[Dshield] New Nimda ?

Malcolm Joosse malcolm at hotlinesupport.com
Thu Jul 11 05:45:26 GMT 2002

Hello All,
Thank you for everyone submitting to this list, I have learnt alot from the brain trust that activly submits to this list.

I am currently being attacked by a site on Port 80.  It looks like Nimda and is busy scanning our /22 range, but our firewall  is doing its job.  The weird thing is that when I pingged the attacking host it instantly replyed with 10 ICMP ping packets back to the IP I was pinging from.  Is this a new Nimda varient that I have not heard about ?
I tried from 3 different hosts and each time I got reversed pingged by the attacking host.
Very weird.

More information about the list mailing list