[cobalt-users] blocking Code Red attempts? RaQ3

["Technic - Alfa-1 Associates" <technic@xxxxxxxxxx>]

FantasticMoms.com asks:

"I seem to be getting hit with Code Red Worm attacks quite a few times from
the same Ip address.  The address block virtually always begins with 66.51,
and seems to only be 4 or 5 different addresses.

Is there a way I can prevent this from reaching my server, as it is filling
up my log files with spurious entries.  I am hit with this thousands of
times per month.

I really don't want to block a whole section of the population though, so
what's the safest way of doing this?"

This procedure is described by Mr. Christopher S L Heng in his article,
"What is default.ida? Defending Your Site From the Code Red II Worm" at:
http://www.thesitewizard.com/news/coderediiworm.shtml

Regards all

Mustafa Cavcar
technic@xxxxxxxxxx