[21706] in bugtraq
Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm.
daemon@ATHENA.MIT.EDU (Vern Paxson)
Fri Jul 20 01:43:20 2001
Message-Id: <200107200532.f6K5WMF17364@daffy.ee.lbl.gov>
To: nick@virus-l.demon.co.uk
Cc: BUGTRAQ <BUGTRAQ@securityfocus.com>
In-reply-to: Your message of Fri, 20 Jul 2001 17:26:33 PDT.
Date: Thu, 19 Jul 2001 22:32:22 PDT
From: Vern Paxson <vern@ee.lbl.gov>
> No -- it is "constrained" because it has reached the *UTC date* (not
> time as initially reported) when it is programmed to switch from
> "spread like crazy" mode to "DoS one of the IPs that was part of
> www.whitehouse.gov" mode. In about ten days it will flick back to
> the "spread like crazy" mode.
I've got to wonder about this - I've been tracing whitehouse.gov
(both old and new addresses) at several locations, and I'm not
seeing much traffic to it.
Vern
