Security Incidents mailing list archives
http://www.worm.com/default.ida? requests
From: Sean Kelly <lists () shortestpath org>
Date: Wed, 1 Aug 2001 16:36:18 +0100 (BST)
My webcache is having a massive ammount of requests for http://www.worm.com/default.ida?. Is this an infected machine trying to scan, or is this a scanner trying to detect compromised hosts? I have found a reference to www.worm.com in a document saying it is part of the text placed on the homepage of a web server that has been defaced by Code Red. Thanks, -- Sean Kelly ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- http://www.worm.com/default.ida? requests Sean Kelly (Aug 01)
- Re: http://www.worm.com/default.ida? requests Robin Stevens (Aug 01)
- RE: http://www.worm.com/default.ida? requests Marc Maiffret (Aug 01)
- <Possible follow-ups>
- RE: http://www.worm.com/default.ida? requests Johnston, Jack (Aug 01)
- Re: http://www.worm.com/default.ida? requests Robin Stevens (Aug 01)