[42685] in North American Network Operators' Group
Re: Online DB of IPs for Nimda worm infected machines
daemon@ATHENA.MIT.EDU (Ulf Zimmermann)
Tue Sep 18 20:10:53 2001
Date: Tue, 18 Sep 2001 17:06:46 -0700
From: Ulf Zimmermann <ulf@Alameda.net>
To: "Rubens Kuhl Jr." <rkuhljr@uol.com.br>
Cc: ulf@Alameda.net, nanog@nanog.org
Message-ID: <20010918170646.R2286@seven.alameda.net>
Reply-To: ulf@Alameda.net
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <5.1.0.14.0.20010918194304.030d86a0@pop3.uol.com.br>; from rkuhljr@uol.com.br on Tue, Sep 18, 2001 at 07:44:44PM -0300
Errors-To: owner-nanog-outgoing@merit.edu
On Tue, Sep 18, 2001 at 07:44:44PM -0300, Rubens Kuhl Jr. wrote:
>
> Please list probe time also. Dynamic IPs can only be traced to the actual
> infected user with a time stamp.
Valid point. Hmmm, let me rearchitect this a bit to be able to track
that.
>
>
> Rubens Kuhl Jr.
>
>
> > http://seven.alameda.net/~ulf/nimda/
> >
> >I put a page to search for infected IPs. This is the first version.
> >Currently I put IPs into it which probed me before about 2pm PDT.
> >I got email from 2 people who sent me their IPs, which I am going
> >to add when they ok it.
> >
> >You can right now search by SQL for IPs like: 64.81.%
> >This will display all IPs which probed me starting
> >with 64.81.
> >
> >Things I am adding in the next minutes is so that people
> >can submit them self single IPs or bulk list.
>
>
--
Regards, Ulf.
---------------------------------------------------------------------
Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204