Okay, thank you for the information. It is NIMBDA scanning for code red II infected and other vulnerable hosts. As I'm running Linux, there seems to be no risk for my system. Thank you again. Stephan