[42661] in North American Network Operators' Group
Re: Worm probes
daemon@ATHENA.MIT.EDU (Ulf Zimmermann)
Tue Sep 18 17:14:28 2001
Date: Tue, 18 Sep 2001 13:37:35 -0700
From: Ulf Zimmermann <ulf@Alameda.net>
To: "Smith, Rick" <rsmith@atsworld.com>
Cc: nanog@merit.edu
Message-ID: <20010918133735.M2286@seven.alameda.net>
Reply-To: ulf@Alameda.net
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <88786160BFD1D211B10800A0C9EC744EE1B050@CORP>; from rsmith@atsworld.com on Tue, Sep 18, 2001 at 03:35:46PM -0400
Errors-To: owner-nanog-outgoing@merit.edu
On Tue, Sep 18, 2001 at 03:35:46PM -0400, Smith, Rick wrote:
>
>
> I've seen 2,614 unique addresses. I'd be willing to do the same. Or
> contribute to the effort.
>
> -----Original Message-----
> From: Ulf Zimmermann [mailto:ulf@Alameda.net]
> Sent: Tuesday, September 18, 2001 2:32 PM
> To: sigma@pair.com
> Cc: nanog@merit.edu
> Subject: Re: Worm probes
>
>
>
> On Tue, Sep 18, 2001 at 01:36:48PM -0400, sigma@pair.com wrote:
> >
> >
> > Along those lines, weren't there some projects last time around to find
> and
> > clean up the affected machines? Clearly there are LOTS of vulnerable NT
> > servers still out there. Presumably these are being responded to just
> like
> > Smurf amplifiers, and the problem is just that the admins are clueless or
> > unreachable?
> >
> > So far the most prolific network probing us has belonged to 9NetAve, which
> > was bought by Concentric shortly before they became XO.
>
> I got so far about 205 unique IPs from the scans. If anyone is interested
> I can put them on a webpage. Or even put quickly a script with db in
> the back for other people to provide their list of IPs.
>
> >
> > Kevin
> >
> > > Hopefully the notification does some good.
> > >
> >
> >
>
> --
> Regards, Ulf.
>
> ---------------------------------------------------------------------
> Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204
Little page with DB backend will be up in a few minutes I hope. Data
included is just IP, email of submitter, date and comment.
--
Regards, Ulf.
---------------------------------------------------------------------
Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204
