Re: [cobalt-users] Code Red

["Jim Scott" <cobaltlist@xxxxxxxxxxxx>]

I like the idea of it automatically emailing the admin of the network. That
would be a great idea.

Jim

----- Original Message -----
From: "Jason Vaughan" <cobaltlist@xxxxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Thursday, August 09, 2001 11:34 AM
Subject: [cobalt-users] Code Red


> There have been frequent threads about Code Red and even a few
> scripts to check how many times it has attacked.
>
> Here is a challenge for any top scripters out there...
>
> Write a script which monitors the access log and if it sees tell tale
> signs (e.g requests for .ida) it then blocks that IP address, using
> IPCHAINS or similar.
>
> I don't even know if this would help but if the Code Red could not
> even see the server, would it not just go away and bother someone
> else?
>
> Even better would be to log the IP address, do a dig on the results
> and send an abusive message to the administrator of the site it
> resolves to (if available) or the admin for the IP block.
>
> Jason Vaughan
> Netergy.com
> --
>   ---------------------------------------------
> Jason Vaughan
>         Netergy.com Limited
>         Studio 1B, 101 Farm Lane, London SW6 1QJ
>         T: 020 7610 1010 - F: 020 7610 1551
>         http://www.netergy.com
>         http://www.anynames.com
>   ---------------------------------------------
>
>   IMPORTANT LEGAL NOTICE:
>   This e-mail is strictly confidential and is intended solely for the
> person or organisation to whom it is addressed. It may contain
> privileged and confidential information and if you are not the
> intended recipient, you must not copy, distribute or take any action
> in reliance on it. If you have received this communication in error,
> please advise us by e-mail and delete the file from your system.
>
>   If you contact us by e-mail, we will store your name and address to
> facilitate communications.
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>