On Monday, May 5, 2003, at 14:58 Canada/Eastern, Sean Donelan wrote:
The attacks APPEAR to be originating from India and a virus called YAHA which targets certain Pakistan government web sites, .PK top-level domain name servers and the primary Internet exchange in Pakistan.
Two (of three) of the PK servers are in the US (in AS701). If the attacks were happening due to some generally-distributed windows worm, and were targetting the PK servers with any degree of ferocity, you'd think this would be more than just a South Asian problem. It's possible, of course, that the extremely different scales of infrastructure deployment in South Asia compared with the 701 backbone could cause the same attack traffic to be highly disruptive to the former, and yet barely noticable by the latter. Joe