[NTLUG:Discuss] new worm going around?

[Kyle Davenport]

*** Authentication Certificate ***

> Jack Snodgrass scribed:
>>On Mon, 2004-06-28 at 11:20, Kyle Davenport wrote:
>> I just checked my firewall this morning and it's going crazy on port
>> 11170/UDP.   In fact, 9500 of 10500 blocked and logged accesses came
from
>> that alone just today.  I can't find any information on it online.
Anyone?
>
> my firewall log has been getting 600-700 entries per day for
> the last week or so.... it's 3000 so far today and we're only
> half-way through. I wonder what's going on.... none of the virus
> sites have any breaking news.

Check this out:

http://www.incidents.org/port_details.php?isc=45a9ccdab99d5863061493abc8e271ba&port=11170&repax=1&tarax=2&srcax=2&percent=N&days=40

they show some increase over the past week, but still no explanation.   I
did scans and most were filtered with only an unresponsive port 80 open.
Geographical scans show they are from all over the world...  Very curious.

Kyle