http://www.worm.com/default.ida? requests

        My webcache is having a massive ammount of requests for
http://www.worm.com/default.ida?. Is this an infected machine trying to
scan, or is this a scanner trying to detect compromised hosts?

        I have found a reference to www.worm.com in a document saying it
is part of the text placed on the homepage of a web server that has been
defaced by Code Red.

        Thanks,

--
Sean Kelly
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com