[Xitami] "GET /scripts/.......

[Paul Reid]

> Bandwidth seems uneffected at this point as we are only getting a few thousand hits per day from it, but this might change as the worm gets more wide spread 

My university's estimate is that "all vulnerable machines" were infected
in a few hours. Infected machines are slowly realizing it and fixing it,
while new machines come on-line and get infested... the traffic is
probably stable or declining overall. 

> or if you have a better known site.

This one, like CodeRed, does not know if you are "known" or even if you
exist. It picks IP numbers semi-randomly. It seems to favor "nearby
numbers"... I'm getting a lot of hits from 165.2xx.xxx.xxx addresses. So
you may see a surge if a clump of machines on IP numbers near you infect
each other and start pinging "nearby" IP numbers. 

Aside from log-file growth: I was using a custom 404 Error page with a
graphic. They are welcome to my 100 bytes of text. But the graphic is
pointless when 99% of my 404s today are from worms. I'll probably omit
the graphic and cut the number of packets in half. 

 -PRR