[Dshield] Code Red Vers. 1 sightings.
Johannes B. Ullrich
jullrich at euclidian.com
Tue Oct 9 14:55:29 GMT 2001
-----BEGIN PGP SIGNED MESSAGE-----
After CodeRed shut itself off on Oct. 1st, the door is open again for CRI
to spread. We did already receive a few sightings. However, as there was
almost a week of quiet time, it would be interesting to get the first one.
Please check your web logs and see if they include the typical
signature... here is a sample:
126.96.36.199 - - [07/Oct/2001:10:39:55 -0400] "GET
HTTP/1.0" 400 326
Please only send the earliest few samples you have in your logs from
October. Just send them to me directly (jullrich at dshield.org).
jullrich at sans.org Join http://www.DShield.org
Distributed Intrusion Detection System
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
-----END PGP SIGNATURE-----
More information about the list