[Dshield] New Nimda ?
malcolm at hotlinesupport.com
Thu Jul 11 05:45:26 GMT 2002
Thank you for everyone submitting to this list, I have learnt alot from the brain trust that activly submits to this list.
I am currently being attacked by a site on Port 80. It looks like Nimda and is busy scanning our /22 range, but our firewall is doing its job. The weird thing is that when I pingged the attacking host it instantly replyed with 10 ICMP ping packets back to the IP I was pinging from. Is this a new Nimda varient that I have not heard about ?
I tried from 3 different hosts and each time I got reversed pingged by the attacking host.
More information about the list