RE: CR2 question

["Smith, Rick" <rsmith () atsworld com>]

I'm actually seeing several thousand port 80 scans per hour !  

Code Red Log Checker 
Beginning Time... 
20:00:01 
Ending Time: 
21:00:00 
Number of attacks... 
    3137 
Number of unique addresses... 
     287 



-----Original Message-----
From: Todd Suiter
To: nanog () merit edu
Sent: 8/25/01 4:34 PM
Subject: CR2 question


Folks,


        Its been almost a month, and my IDS is still picking up several
hundred CodeRed 2 attacks a day. Is anyone else seeing this same level
of continued
activity of this worm? I personally am somewhat at a loss as to how to
contact
people who are affected, as automated broadcasts to people, in my
opinion, are
NOT the way to go. BUT, going through several hundred IPs, a day, and
trying
to find someone at those organizations to speak to is A LOT of work. Any
ideas?

Thanks!

todd