[Dshield] CodeRed Difference with 'new' XXX variant

Dan Stetser dan at pacinternet.com
Sun Aug 5 08:27:26 GMT 2001


At 04:50 PM 8/4/2001 -0500, you wrote:
>When I first noticed the new variant of Code Red exploit attempt today, I
>noticed the new 'GET' lines containing the XXXXX's (rather than the NNNNN's)
>all had the same first octet as my IP address -- 63. .

There's a good amount of info on the "Code Red II" Variant here:

http://www.unixwiz.net/techtips/CodeRedII.html






More information about the list mailing list