[rescue] [OT] CodeRed activity?

[Adam Kropelin]

At 11:46 PM 8/4/2001 -0400, you wrote:
>On Sat, Aug 04, 2001 at 10:34:45PM -0500, Phil Brutsche wrote:
> >
> > I think it's more likely that this worm is limiting itself to the /8
> > that it finds itself being hosted in.
>
>good guess, but i've seen probes from outside my /8 so that's not it.
>
>-brian

Perhaps it starts with its /8 and goes beyond it only later. There's a 
definite pattern here since I've only seen one v3 scan from outside my /8 
yet v1+v2 scans are nearly all from outside it.

--Adam