On Mon, 6 Aug 2001, Steve Siegfried wrote: > Yeah, for the latest variant (with X's instead of N's in the http ref), I'm > at over 300 hits too.... > > Between the broadcast pinging and the portscans, my cable modem's receive light > was lit almost constantly yesterday from about 5pm on. > > Of the CodeRedII hits that nslookup doesn't fail on, nslookup showed they came > from: > 48% .home.com > 18% .rr.com > 7% .mediaone.net > 4% .shawcable.net > 4% .dyn.optonline.net > > It almost looks like the damn thing was tailored to go after cable customers. Let me guess, you're on a cable modem? This thing is 'smart' -- it scans it's own /24 first, then it's /16, then it's /8.. -- Nate Carlson <natecars at real-time.com> | Phone : (952)943-8700 http://www.real-time.com | Fax : (952)943-8500