Which of the following worms performs random scanning?

BugBear was an email-borne worm that spread through malicious attachments and open network shares, not through random IP scanning.

SirCam spread via email by harvesting addresses from the victim's address book and attaching itself to forwarded documents, using no random IP scanning.

Code Red exploited a buffer overflow in Microsoft IIS (CVE-2001-0500) and propagated by generating random 32-bit IP addresses and sending exploit requests to port 80 on each. This purely random scanning strategy - rather than list-based or local-subnet scanning - was a key characteristic that allowed it to infect hundreds of thousands of hosts within hours.

Klez was a mass-mailing email worm that also spread via network shares; it did not use random IP address scanning as its propagation method.