[Dshield] Code red variant?

Thompson, John J ThompsonJJ at mail.medicine.uiowa.edu
Thu Jul 26 14:57:13 GMT 2001


I checked the incidents.org site and didn't see anythign regarding this, but
perhaps one of you has seen this too. Today, around 7:45am CST, I saw the
now familiar HTTP GET data with repeated character alert from BlackIce. When
I looked at the actual log, I found that it wasn't the same signature as
before... Instead, it was:
 
length=222&URL=/x.ida&arg=AAA* (with 219 more a's following). 
 
Anyone else seen this or know what it is?
 
John
 
------------------------------------
John Thompson
Network Administrator
Dept. of Biochemistry
University of Iowa
tel: 319.335.7952
fax: 319.335.9570
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.dshield.org/pipermail/list/attachments/20010726/685ca2c1/attachment.htm


More information about the list mailing list