Internet Storm Centre, status YELLOW
03-05-2004, 21:09
|
#1
|
|
Inactive
Join Date: Mar 2004
Services: BB:M, TV:XL, Phone:M, Loyalty
Posts: 2,516
|
Internet Storm Centre, status YELLOW
http://isc.sans.org/index.php
Flash Update (May 3rd 09:30 AM): We did receive some initial reports about a significant rise in ICMP traffic, which may point to a new worm with Nachi style ICMP component
Seen it, a new ping-stormer definitely seems to be out there, in addition to the other worms.
Not seen significant NTL-source hits, but this thing looks like it hits a whole class A address block, and there's some pretty bad company in the 80.x.x.x range.
Maybe NTL's port blocking is now paying off, and at least some of the worms are being headed off at the pass.
|
|
|
|
03-05-2004, 22:17
|
#2
|
|
Dr Pepper Addict
Cable Forum Admin
Join Date: Oct 2003
Location: Nottingham
Age: 63
Services: Zen & YouFibre FTTP, Sky Q TV, Sky Mobile, Flextel SIP
Posts: 31,339
|
Re: Internet Storm Centre, status YELLOW
I notice some little ntl based swine has been probing me several times tonight on ports 3127 & 6129. Strangely his IP reverse lookup is a manchester based xxxxx.broadband.ntl.com (as opposed to the normal xxxxx.cable.ntl.com). Is this some form of non cable broadband connection from ntl ?
__________________
 Baby, I was born this way.
|
|
|
|
|
04-05-2004, 11:13
|
#3
|
|
In the corner, sulking.
Join Date: Jun 2003
Location: Shaw, Oldham, Lancashire.
Services: 2 TV 360 boxes. 500mb BB, Phone line.
Posts: 8,041
|
Re: Internet Storm Centre, status YELLOW
Quote:
|
Originally Posted by Pem
I notice some little ntl based swine has been probing me several times tonight on ports 3127 & 6129. Strangely his IP reverse lookup is a manchester based xxxxx.broadband.ntl.com (as opposed to the normal xxxxx.cable.ntl.com). Is this some form of non cable broadband connection from ntl ?
|
90% of my recent scans from Ntl users are from xxxxx.broadband.ntl.com only the odd one from xxxx.cable.ntl.com
|
|
|
|
|
04-05-2004, 11:28
|
#4
|
|
Inactive
Join Date: Oct 2003
Location: Cambridge
Posts: 567
|
Re: Internet Storm Centre, status YELLOW
Quote:
|
Originally Posted by Pem
his IP reverse lookup is a manchester based xxxxx.broadband.ntl.com (as opposed to the normal xxxxx.cable.ntl.com). Is this some form of non cable broadband connection from ntl ?
|
*.broadband.ntl.com is normal for STB users and ex-C&W area;
*.cable.ntl.com is normal for cable modem users in non C&W areas.
|
|
|
|
|
04-05-2004, 12:57
|
#5
|
|
Dr Pepper Addict
Cable Forum Admin
Join Date: Oct 2003
Location: Nottingham
Age: 63
Services: Zen & YouFibre FTTP, Sky Q TV, Sky Mobile, Flextel SIP
Posts: 31,339
|
Re: Internet Storm Centre, status YELLOW
Quote:
|
Originally Posted by rdhw
*.broadband.ntl.com is normal for STB users and ex-C&W area;
*.cable.ntl.com is normal for cable modem users in non C&W areas.
|
Well you live & learn - thanks Robin.
__________________
Baby, I was born this way.
|
|
|
|
Posting Rules
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is Off
|
|
|
All times are GMT. The time now is 22:35.
|
Join CF
You are here: 
