On Thu, 26 Feb 2026 12:02:12 +0000 Mike Simpson via NANOG <nanog@lists.nanog.org> wrote:
Point your ids onto the outside your inet interface and you’ll still see slammer, nimda (SadminD), comficker and all the other worms still scanning , still propagating.
I looked for Slammer on lots of different vantage points a few years ago and no evidence it was still running anywhere on the public Internet. I'd be interested to see evidence to the contrary. I think it is dead unless someone can show me otherwise. I'm not sure if the Conficker sinkholes are still running. We had one while I was at Team Cymru and it was still running as of about 2016 or so, but I'd be surprised if they have kept it going this long - most of the registrars had stopped sinking names a long time ago. Traffic had fallen off quite a bit, but maybe it's not yet down to zero? I'd be very surprised if Nimda is still around (same goes for Code Red). Plenty of other junk to see though. :-) John