Re: 1434 UDP SLAMMER

[Michael Anderson <mca () arlut utexas edu>]

I saw scans from Italy and Germany back in October. I've also heard of
scans all the way back in January.

-Mike

Vadim Pushkin wrote:

> I read in Snort archives a posting by Michael C. Ibarra
> from back in Nov and Dec 2002 stating that he sees
> much scans to his sensors on this port. See archives. I
> ask him and he says that scans came from Korea.
> Seem to me that this was deliberate, maybe from
> there? According to his data.
>
> Vadim Anatoly Pushkin
> -- The Ukranian Stallion --
>
>
>
>
>
> > From: A`I` A'Ø <mistra_knight () hotmail com>
> > To: snort-users () lists sourceforge net
> > Subject: [Snort-users] 1434 UDP SLAMMER
> > Date: Wed, 29 Jan 2003 08:51:35 +0000
>
>
> _________________________________________________________________
> MSN 8 with e-mail virus protection service: 2 months FREE*
> http://join.msn.com/?page=features/virus
>
> ------------------------------------------------------------------------
>
> Subject:
> [Snort-users] 1434 UDP SLAMMER
> From:
> 이 준 <mistra_knight () hotmail com>
> Date:
> Wed, 29 Jan 2003 08:51:35 +0000
> To:
> snort-users () lists sourceforge net
>
>
>
> Hi
>
> In Korea, Slammer occured on Saturday, 25, Jan14:00 (GMT: Sat, 25,
> Jan, 5:00 :maybe Korea attacked first) And ISP's DNS Servers went down
>
> Infew hours, Korea's all ISP's down :-(
>
> I think thatISP's sets SQL server and DNS server in same Network..
>
> Or Hacker Get ISP's access authority
>
> um.. how about your opnion?
>
> And Any Other ISP's down?
>
> /Lee June
>
>
> ------------------------------------------------------------------------
> 도처에 도사리는 재해의 위험들. AIG의 무료보험
> <http://g.msn.com/8HMOKOKR/2755> 으로 해결하세요.
> ------------------------------------------------------- This SF.NET
> email is sponsored by: SourceForge Enterprise Edition + IBM +
> LinuxWorld = Something 2 See! http://www.vasoftware.com
> _______________________________________________ Snort-users mailing
> list Snort-users () lists sourceforge net Go to this URL to change user
> options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users
> list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users