[Dshield] Increasing number of SQL_Slammer_Worm

Jonathan C. Webster jwebster03 at snet.net
Sat Aug 13 15:13:46 GMT 2005


> On 8/12/05, Henderson, Henry <Henry.Henderson at oa.mo.gov> wrote:
> 
>>In the last couple of days we have been seeing a increasing number of
>>SQL_Slammer_Worm attempts against our public sites.
>>
>>A high number are from Asian countries, is anyone else seeing this.
>>
>>
>>Time                                                     Tag Name
>>Event Count       Severity Source IP          Target IP           Object
>>Name
>>
>>2005-08-11 07:43:57 CDT           SQL_SSRP_Slammer_Worm      726
>>High      219.132.16.242  XXX.XXX192.162            1434
>>
My "hit signature" for yesterday showed both increased hits to 1434 and 6129 (Dameware?). I have dynamic aDSL.
The 1026,1027 stuff is always there.

ports most probed
       8 22
      16 137
     349 1026
     186 1027
       8 1433
      26 1434
       3 2100
       3 4899
     145 6129
       4 6346
Jonathan


More information about the list mailing list