Subject: Re: Security Issues...
From: Robert Brandtjen (rob@prometheusmedia.com)
Date: Tue Aug 14 2001 - 11:33:06 MDT
on 8/13/01 11:17 PM, Larry Blodgett at blodgett@telocity.com wrote:
> These are simply Code Red tries to access your Microsoft IIS web
> server. Since, you don't have one, don't worry. Yes it is causing a
> lot of noise on the internet.
>
>> 4.21.22.189 - - [12/Aug/2001:04:11:52 -0400] "GET
>> /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX$
>> 24.182.1.195 - - [12/Aug/2001:04:27:09 -0400] "GET
>> /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX$
>> 24.254.41.153 - - [12/Aug/2001:04:30:07 -0400] "GET
>> /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX$
>> 24.12.7.35 - - [12/Aug/2001:04:35:02 -0400] "GET
>> /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>> X$
>> 24.182.165.183 - - [12/Aug/2001:04:38:24 -0400] "GET
>> /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX$
>> 24.182.60.67 - - [12/Aug/2001:05:00:24 -0400] "GET
Do what I did - get a funny script that shuts them down while killing IIs
and emailing them. you can get it from me here:
http://ns1.prometheusmedia.com/default.ida
Robert Brandtjen
--------------------------------------
Web Site Creation and Hosting Services
Hostmaster@prometheusmedia.com
www.prometheusmedia.com
This archive was generated by hypermail 2a24 : Tue Aug 14 2001 - 10:41:15 MDT