Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm.

[Vern Paxson]

> No -- it is "constrained" because it has reached the *UTC date* (not 
> time as initially reported) when it is programmed to switch from 
> "spread like crazy" mode to "DoS one of the IPs that was part of 
> www.whitehouse.gov" mode.  In about ten days it will flick back to 
> the "spread like crazy" mode.

I've got to wonder about this - I've been tracing whitehouse.gov
(both old and new addresses) at several locations, and I'm not
seeing much traffic to it.

                Vern