[ale] CodeRed attacks, here we go again.

[SAngell at nan.net]

I am on hold with them as we speak. I knew it was Bellsouth as we are also a
customer!


\_\_\_\_\_\_\_\_\_\_\_/_/_/_/_/_/_/_/_/_/_/
\_    Steve Angell,  MCSE, CCNA           _/
\_    MIS Operations Manager               _/
\_    TSYS Total Debt Management  _/
\_    Norcross, GA                                   _/
\_    Phone 770-409-5570                    _/
\_    Fax      770-416-1752                   _/
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/


|--------+------------------------>
|        |          Jonathan      |
|        |          Rickman       |
|        |          <jonathan at xcor|
|        |          ps.net>       |
|        |                        |
|        |          09/18/01 10:06|
|        |          AM            |
|        |                        |
|--------+------------------------>
  >--------------------------------------------------------|
  |                                                        |
  |      To:     SAngell                                   |
  |      cc:     ale at ale.org                               |
  |      Subject:     Re: [ale] CodeRed attacks, here we go|
  |       again.                                           |
  >--------------------------------------------------------|





On Sun, 18 Nov 2001 SAngell at nan.net wrote:

> I am being flooded by Code Red attacks originating from network 205.152.x.x
all
> by the variant which is attempting to drop the trojan backdoor on to my
servers.
> either root.exe or explorer.exe. This attack is worse that any I have
previously
> seen with hundreds of attempts in the last 5 minutes.
>
> Anyone else witnessing these?

YES...big time. I'm calling Bellsouth now. It's their network...

--
Jonathan Rickman
X Corps Security
http://www.xcorps.net

--
To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message body.



--
To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message body.