Re: Code Red, anyone?

["Kman" <mailing_list () hostpacific com>]

> From 79 IP we're taking care of (64.xxxx), nothing as of 8 hrs ago.  But
now... grepping apache log file, it's coming from 146 different IP.

The other side of the world, from 12 IP we're taking care of (202.xxx),
nothing as of 8 hrs ago too.  Now, it's from 16 different IP.

<apache log>
[Wed Aug  1 19:53:55 2001] [error] [client 150.217.19.128] Client sent
malformed Host header
[Wed Aug  1 21:54:45 2001] [error] [client 212.134.97.35] Client sent
malformed Host header
[Wed Aug  1 21:58:33 2001] [error] [client 213.139.198.242] Client sent
malformed Host header
[Wed Aug  1 22:09:09 2001] [error] [client 139.130.171.236] Client sent
malformed Host header
[Wed Aug  1 22:13:53 2001] [error] [client 212.4.8.245] Client sent
malformed Host header
[Wed Aug  1 22:17:19 2001] [error] [client 62.81.192.143] Client sent
malformed Host header
[Wed Aug  1 22:58:29 2001] [error] [client 193.89.189.135] Client sent
malformed Host header
</apache log>

Kittiwat Manosuthi



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com