We're still in the propogation mode, until the 20th.
 
http://www.cert.org/advisories/CA-2001-23.html
 
Unless their clocks are off by 3 days, they're in the wrong mode ...
 
However, since 1100EST 3-17-03, we've seen a steady uptick also.  Also, some other tools must be attempting to use the same exploits, but they are more ferocious, creating thousands of attempts within a few minutes, exploiting the same vulnerabilities.
-----Original Message-----
From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of McBurnett, Jim
Sent: Tuesday, March 18, 2003 12:50 PM
To: nanog@merit.edu
Subject: Code red- Returning?

Has anyone out there noticed an increase in a Code-Red patterned virus?
I know about the Microsoft bug that came out yesterday/last night.
But I am seeing the same symptoms as Code Red,
800+ hits in the last 12 hours, from the same Class A network I am on.
The amount is increasing per hour..
It started with 50 the first hour and now it just about 150 an hour...

Thoughts?

thanks,
Jim