Code Red : Any people around?

Jasper Wallace jasper at
Thu Jul 19 23:41:06 UTC 2001

According to a recent post on bugtraq the worm is going to switch from
infecting webservers to DDOS'ing in about 1/2 an hour or so.

Now i'm not certain if the worm has a hardcoded ip to attack or will do a
DNS lookup for, but if it is going to do a dns lookup then
they've still got a chance to change the A records in their dns records to
something else, like

Unfortunatly this will make it hard for people to track down and fix
infected boxes, so if they could use an ip in a non-routable block,
that's unlickley to be used for anything else, e.g., which in
on the 'TEST-NET', or possible on, which is on the range HP
use for printer auto configuration (they only use

The TTL on the A RR for is 24 hours unfortunatly. :-(

Internet Vision          Internet Consultancy           Tel: 020 7589 4500
60 Albert Court            & Web development            Fax: 020 7589 4522
Prince Consort Road                                   vision at
London SW7 2BE                         

More information about the NANOG mailing list