[39670] in North American Network Operators' Group
RE: 3+ hours into "Code Red" (BST)
daemon@ATHENA.MIT.EDU (Joe Blanchard)
Thu Jul 19 22:56:56 2001
Message-ID: <E9BBE0941932D511934C0002A52CDB4E2D0792@sj-exchange.wyse.com>
From: Joe Blanchard <jblanchard@wyse.com>
To: nanog@merit.edu
Date: Thu, 19 Jul 2001 19:55:22 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C110C7.6B693D80"
Errors-To: owner-nanog-outgoing@merit.edu
This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
------_=_NextPart_001_01C110C7.6B693D80
Content-Type: text/plain;
charset="iso-8859-1"
Oddly, right around 5pm(PST) I noticed less and less traffic(scans at my
firewall) looking for tcp port 80. At the height of today 50% of our traffic
on one of our T1s was various foreign addresses looking for open http
servers. This is much more then usual and at first thought to be a spoof
attack, but the nodes being scanned were too random. Don't know, but most of
the ips we logged turned out to be MS IIS none patched boxes. Wonder if
these hits on valid http servers are counted as hits and charged to the
advertisers? lol.
Oh well.
-Joe
------_=_NextPart_001_01C110C7.6B693D80
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2653.12">
<TITLE>RE: 3+ hours into "Code Red" (BST)</TITLE>
</HEAD>
<BODY>
<BR>
<P><FONT SIZE=3D2>Oddly, right around 5pm(PST) I noticed less and less =
traffic(scans at my firewall) looking for tcp port 80. At the height of =
today 50% of our traffic on one of our T1s was various foreign =
addresses looking for open http servers. This is much more then usual =
and at first thought to be a spoof attack, but the nodes being scanned =
were too random. Don't know, but most of the ips we logged turned out =
to be MS IIS none patched boxes. Wonder if these hits on valid http =
servers are counted as hits and charged to the advertisers? =
lol.</FONT></P>
<P><FONT SIZE=3D2>Oh well.</FONT>
</P>
<P><FONT SIZE=3D2>-Joe</FONT>
</P>
</BODY>
</HTML>
------_=_NextPart_001_01C110C7.6B693D80--
