On Thu, Jul 19, 2001 at 09:16:42PM +0000, kblack at isd.net wrote: > Is anybody else running a firewall > (and blocking port 80) > noticing an unusual number of attacks today? I've got a little more information by virtue of seeing this in my apache logs instead of firewall logs... > I usually log a couple of wayward souls, but today I would > say that number is in excess of 20 separate ip's from around > the world. Sounds about right. I've logged 18 at home and 33 on the office web server. > Not that this is doing anything but sucking up that > could be put to a good use, just wanted to see if anybody > knows if anything unusual is happening. Just a worm looking for copies of IIS and hoping to exploit a buffer overflow. The requests start off with "GET /default.ida?NNNN..." and are too large to be anything but a buffer overflow attempt. The only article I've been able to find about the worm is at http://www.newsbytes.com/news/01/168003.html?&_ref=923747745 -- It's as if we outlawed cars on the principle that they could be used to help crooks escape from bank robberies. - Dan Gillmore on the DMCA