Code Red Hammering Away

Sat Aug 4 21:24:29 UTC 2001

Le (On) Sat, Aug 04, 2001 at 05:14:09PM -0400, Bob K ecrivit (wrote):
> 
> > > 4:53:48pm|melange at host:/home/melange> grep default.ida /var/log/httpd-access.log | grep XXXXX | wc -l
> > >        6
> > 
> > I've started seeing LOTS of XXXXX hits as of approx 1 hour ago.
> > 5 in one hour and counting...
> 
> Just for reference, here's the logs of this new variant:

Pretty interesting, maybe all nanog-post subscribers could share their
experience with this worm too. Especially if you've seen a lot of non-[XN]
alphanumerical chars.

Sorry, but this worm caused more damages to mailing lists than anything
else, on the Internet. Looks more like a chain-letter...