[Xitami] A Hack Attempt or What?

[Ewen McNeill]

In message <20010805183840.17246.cpmta@c012.sfo.cp.net>, GunnarSwan writes:
>[CodeRed requests]
>Again, I am running Xitami on NT set up as a bastion host.  
>Is it safe to assume that all the IP addresses in my Access and Error logs ... 
>that all those machines have been infected?

Yup.  It's the infecting machines which try to access yours with that
CodeRed (default.ida?[NX]*....) pattern, in order to infect yours (if it
was IIS -- they just try to infect, they don't check what it is first).

So yes, you're building up your very own list of infected machines.  And
if they start getting infected with CodeRedII (see, eg, Slashdot
yesterday) then they're even more at risk.

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com