I'm actually seeing several thousand port 80 scans per hour ! Code Red Log Checker Beginning Time... 20:00:01 Ending Time: 21:00:00 Number of attacks... 3137 Number of unique addresses... 287 -----Original Message----- From: Todd Suiter To: nanog@merit.edu Sent: 8/25/01 4:34 PM Subject: CR2 question Folks, Its been almost a month, and my IDS is still picking up several hundred CodeRed 2 attacks a day. Is anyone else seeing this same level of continued activity of this worm? I personally am somewhat at a loss as to how to contact people who are affected, as automated broadcasts to people, in my opinion, are NOT the way to go. BUT, going through several hundred IPs, a day, and trying to find someone at those organizations to speak to is A LOT of work. Any ideas? Thanks! todd