[Dshield] Increasing number of SQL_Slammer_Worm

Henderson, Henry Henry.Henderson at oa.mo.gov
Fri Aug 12 18:15:31 GMT 2005


In the last couple of days we have been seeing a increasing number of
SQL_Slammer_Worm attempts against our public sites.

A high number are from Asian countries, is anyone else seeing this.

 

Tag Name                                 Severity  Event Count Source
Count Target Count  Object Count     Earliest Event            Latest
Event

SQL_SSRP_Slammer_Worm      High      2,124334           1440
12654               1          2005-08-10 07:00:00 CDT
2005-08-12 12:00:00 CDT

 

Time                                                     Tag Name
Event Count       Severity Source IP          Target IP           Object
Name

2005-08-11 07:43:57 CDT           SQL_SSRP_Slammer_Worm      726
High      219.132.16.242  XXX.XXX192.162            1434

2005-08-11 09:54:45 CDT           SQL_SSRP_Slammer_Worm      722
High      222.73.0.234     XXX.XXX60.103              1434

2005-08-11 09:37:12 CDT           SQL_SSRP_Slammer_Worm      718
High      61.186.252.184  XXX.XXX209.153            1434

2005-08-11 10:03:49 CDT           SQL_SSRP_Slammer_Worm      718
High      218.89.170.120  XXX.XXX154.240            1434

2005-08-11 09:44:43 CDT           SQL_SSRP_Slammer_Worm      715
High      61.143.101.100  XXX.XXX51.122              1434

2005-08-11 09:36:11 CDT           SQL_SSRP_Slammer_Worm      714
High      219.159.73.220  XXX.XXX15.135              1434

2005-08-11 09:40:40 CDT           SQL_SSRP_Slammer_Worm      708
High      218.251.19.216  XXX.XXX67.67                1434

2005-08-11 07:57:43 CDT           SQL_SSRP_Slammer_Worm      707
High      220.210.112.244 XXX.XXX149.25             1434

2005-08-11 09:48:02 CDT           SQL_SSRP_Slammer_Worm      705
High      83.222.7.36       XXX.XXX114.183            1434

2005-08-11 09:51:05 CDT           SQL_SSRP_Slammer_Worm      704
High      218.251.19.216  XXX.XXX158.203            1434

2005-08-11 09:38:13 CDT           SQL_SSRP_Slammer_Worm      703
High      61.145.116.159  XXX.XXX122.60              1434

 

 

Henry Henderson
Missouri Office of Administration
Information Technology Services Division
Information Security Managment Office
573-526-6923

 



****************************
CONFIDENTIALITY STATEMENT:
This e-mail and any attachments are intended only for those to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure and unauthorized use under applicable law.  If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender.  If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.


More information about the list mailing list