What Does Code Red Do? (4)
Flood phase (days 20-27)
- Between 2000-2359 UTC, worm threads will send 100KB packets to TCP port 80 at 198.137.240.91 (formerly www.whitehouse.gov)
Termination phase (days 28-31)
- Worm goes -- and stays -- dormant
- There was an erroneous report from ISS that 2 of the threads wake up on the 1st, but ISS, CERT/CC, and NIPC have concluded that once asleep, the worm stays asleep