[Xitami-Dev] Weird stuff

[Paul Reid]

> I'm getting about 6 or 7 log entries - with corresponding errors - daily.

I have 58 today: 2 per hour.

>  from random companies, many of them Asian.

The target of Code Red was the US White House site. After spreading to
many machines, on the first day of the month all those machines would
flood the White House site with packets, effectively shutting it down.

As a US EDU site operator, I was told that we have "...an obligation as
a good net neighbor to ensure that our hosts are not contributing to the
spread of this virus."

I believe that most responsible operators in and out of the US took
steps to block CodeRed, but a few may be somewhat sympathetic to the
idea of crashing the White House. And since one phase of the infection
puts up a web page saying "Hacked by chinese", sympathy may run highest
in some parts of Asia. Or they may simply not be reading all the news,
much of which is in english. 

The virus targeted White House by IP number. Knowing that, after the
first wave George's geeks moved the server to another IP number. That
dodged the bullet, but still there is excess network traffic as all the
copies of CodeRed try to find their target. 

If you are not running MS IIS: Forget about it. CodeRed can't infect
Xitami, nor spread from Xitami. 7 or 58 or even hundreds of attempts in
a day isn't hurting your server's performance. If you do get a flood of
attempts, delete your log files if they get too big for your disk. 

 -PRR