[anothermacguy]

Hi all, I just noticed something when looking through my Apache logs. For the past month or so, there have been rpeated attempts at accessing a page which does not exist on my webserver (default.ida). Every one of the ip's attempting to access the non-existent page are on the @home network (24.*.*.*). I don't believe there are any external links to my site, but I could be mistaken. Is there anything to worry about? Or is this just someone who has linked to my site incorrectly? Is there any way I could advise him/her of their mistake? There are pages and pages of this error, it's a bit annoying. I'm going to start rotating logs so that the size doesn't become an issue.... if there is a problem, please advise.

[Mactoid]

Originally posted by anothermacguy:
<STRONG>Hi all, I just noticed something when looking through my Apache logs. For the past month or so, there have been rpeated attempts at accessing a page which does not exist on my webserver (default.ida). Every one of the ip's attempting to access the non-existent page are on the @home network (24.*.*.*). I don't believe there are any external links to my site, but I could be mistaken. Is there anything to worry about? Or is this just someone who has linked to my site incorrectly? Is there any way I could advise him/her of their mistake? There are pages and pages of this error, it's a bit annoying. I'm going to start rotating logs so that the size doesn't become an issue.... if there is a problem, please advise.</STRONG>

Red Code worm ring a bell? Surly you've heard of it. The death of the internet and all. Anyway, it's nothing more than an annoyance unless you have any plans to switch to an Win2k/IIS Server.

FYI, I've had 5116 hits from Red Code since Aug 4. Awhile back when I was bored at work I hacked together a Red Code counter for my home page

[malvolio]

Small correction: Not all 24.xxx.xxx.xxx addresses are @home. I'm using adelphia.net with a 24.xxx.xxx.xxx addy.

[Neilwhit]

Originally posted by Mactoid:
<STRONG>

Red Code worm ring a bell? Surly you've heard of it. The death of the internet and all. Anyway, it's nothing more than an annoyance unless you have any plans to switch to an Win2k/IIS Server.

FYI, I've had 5116 hits from Red Code since Aug 4. Awhile back when I was bored at work I hacked together a Red Code counter for my home page </STRONG>

I was looking at my OSX Apache logs today -- over 7,300 hits from Red Code. Using @home also. Plus I have dozens of other attempts for various Windoze .exe, directories, cgi's, etc., etc. No wonder my server slows down!!

[anothermacguy]

That's crazy. Thanks for the info.

[putamare]

Somebody wrote a php script that makes an attempt to shut down any server that tries to access default.ada, the script (& instructions) are here. The person who wrote it says it doesn't even work half the time, but what the heck? There is an interesting thread at macosx.com about Code Red & ways to monitor and/or perster ther servers pestering you, but they aren't up right now, so I can't link to it.

[putamare]

A good thread about Code Red.

[theolein]

Originally posted by putamare:
<STRONG>Somebody wrote a php script that makes an attempt to shut down any server that tries to access default.ada, the script (& instructions) are here. The person who wrote it says it doesn't even work half the time, but what the heck? There is an interesting thread at macosx.com about Code Red & ways to monitor and/or perster ther servers pestering you, but they aren't up right now, so I can't link to it.</STRONG>

Be veeery careful with this script. This script could be construed as an attempt to hack a server in a court. Very nice all the same.

[putamare]

[Millennium]

That does sound like Code Red.

Luckily, since you're running Apache, you're immune. However, the bandwidth and log file clogging can be a pain, I know.

I'd suggest running the scripts other people have mentioned. Even if you're hauled into court, you could plead self-defense. Granted, I don't know if it would work (I doubt anyone has tried it before), but it's worth a shot.

[Gee4orce]

There is an interesting tutorial on how to write a Perl Apache module to do something with Code Red hits (in this case, email the admin) - available at O'Reilly