Code Red was a computer worm observed on the Internet on July 15, 2001. It attacked computers running Microsoft's IIS web server. The Code Red worm was first discovered and researched by eEye Digital Security employees Marc Maiffret and Ryan Permeh. They named it "Code Red" because Code Red Mountain Dew was what they were drinking at the time. Although the worm had been released on July 13, the largest group of infected computers was seen on July 19, 2001. On this day, the number of infected hosts reached 359,000. The worm exploited a vulnerability in the indexing software distributed with IIS, described in Microsoft Security Bulletin MS01-033. The worm spread itself using a common type of vulnerability known as a [[buffer overflow]]. It did this by using a long string of the repeated character 'N' to overflow a buffer, allowing the worm to execute arbitrary code and infect the machine. Kenneth D. Eichman was the first to discover how to block it. Days 1-19: Trying to spread itself by looking for more IIS servers on the Internet. Days 20–27: Launch [[denial of service]] attacks on several fixed [[IP address]]es. The IP address of the [[White House]] web server was among those. Days 28-end of month: Sleeps, no active attacks. When scanning for vulnerable machines, the worm did not test to see if the server running on a remote machine was running a vulnerable version of IIS, or even to see if it was running IIS at all. The worm's payload is the string following the last 'N'. Due to a buffer overflow, a vulnerable host interprets this string as computer instructions, propagating the worm.

On August 4, 2001, Code Red II appeared. Code Red II is a variant of the original Code Red worm. Although it uses the same injection vector it has a completely different payload. It pseudo-randomly chose targets on the same or different subnets as the infected machines according to