North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Tracing where it started

  • From: Johannes Ullrich
  • Date: Sun Jan 26 11:58:37 2003 
> > +-----------------+
> > | 216.069.032.086 |  Kentucky Community and Technical College System
> > | 066.223.041.231 |  Interland
> > | 216.066.011.120 |  Hurricane Electric
> > | 216.098.178.081 |  V-Span, Inc.
> > +-----------------+
> 
> HE.net seems to be a reoccuring theme. (I speak to evil of them --
> actually, there are some good people over there).

First of all: This worm started so fast, to find its source we have to
look into the past, not at the 'flash point'. HE.net is a very large
colo provider, so I am in no way surprised that they show up. Same
for Interland. 

-- 
--------------------------------------------------------------------
[email protected]             Collaborative Intrusion Detection
                                         join http://www.dshield.org