| reply to Steve
Re: Code Red II worm analysis Good luck at finding a pattern on the scans. Most scans im getting are from other machines on my isp, but nothing else makes sense as far as a pattern is conserned. Some scan one ip and move on, some are scanning blocks if ip's. I have even seen some scan an ip then come back 10-15 mins later to scan another time on the same ip. Like last time they are scanning in 2s or 3s. mostly 3 attempts at a time. Im up to 44 per hour at this time.
Because of the worm scanning mostly on its own isp, it would be a good guess that people with small isp's will get less scans than those on bigger isp's.
Its all interesting to say the least.
--
Life = Just Learning |
