RE: [cobalt-users] Extensive Hack Attack - Was C drive hack

["Dom" <d.latter@xxxxxxx>]

> Major pain. Anyway to detect the origin or at least a waypoint?

You've got the IP...

As yet, no word from the usual sources of information.  So until
somebody "sacrifices" an IIS machine to find out exactly what it
is, it's hard to tell.  It's clearly automated, and the sheer 
scale of it suggests a worm.  It seems to use the CRII trick of
picking "nearby" IP addresses, and it tries a variety of exploits:
checking if there is a CRII backdoor in there and then going on
to try the various "directory traversal" stunts that have been
around a while.