[unisog] Increased Activity

Jason Richardson a00jer1 at wpo.cso.niu.edu
Thu Mar 25 23:37:35 GMT 2004


Note that this is one infection causing this as the same IP is probing
all 
of these
ports on the target machine before moving on. It's not separate worms
as Jason
suggested (thanks for the response though...).

Any idea of what this is would be welcome here as well.

Thanks
Ed Zawacki

Yeah, sorry, I misunderstood what you were asking - I didn't realize
that you meant you had distinct hosts scanning all of those ports.  We
haven't seen much Phatbot yet but we're having a little party with
Nachi.B that is giving our web cache fits.

Jason



More information about the unisog mailing list