Code Red variants

FYI

Odd thing: from a Sprint connected network, he seess the most attempts
from Sprint's Class A.

On my cable-modem connected box through Cox Internet, I see 248 out of
256 attempts coming from *.cox-internet.com.

Does the new variant perhaps try to "stick to it's own domain"? I do
see some non-localdomain stuff as well, so it's not 100% definite, and I
can't say whether or not the providers are proactively filtering inbound
to prevent other providers from getting in.

* Marius Strom <marius@marius.org> [010805 10:38]:

Odd thing: from a Sprint connected network, he seess the most attempts
from Sprint's Class A.

On my cable-modem connected box through Cox Internet, I see 248 out of
256 attempts coming from *.cox-internet.com.

Does the new variant perhaps try to "stick to it's own domain"? I do
see some non-localdomain stuff as well, so it's not 100% definite, and I
can't say whether or not the providers are proactively filtering inbound
to prevent other providers from getting in.

According to another post, it wants to stay in the same /8, /16, and
/24.