Hey: I'm doing a post infection analysis of the Code Red worm. If you could send me any http logs showing hits on default.ida that would help get a larger sampling. cat /var/log/apache_access_log | grep default.ida This command outputs a great format. Thanks, Jon