Slow scan from China ?

From: Arthur Donkers (arthurat_private)
Date: Tue May 08 2001 - 23:58:03 PDT

Next message: Thomas Springer: "who's owning this ip?"

Previous message: yousuc: "IIS and Windows NT/2000"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello All,

Over the past two days we are being slow probed for random ports on random
addresses in our registered C class, including the xxx.xxx.xxx.0 address !

All probes originate from port 80 on an IP address in China. Making a
connection to this port 80 gives a header that attempts to make itslef look
like IIS 5.0, but somehow it is not correct (wrong order of headers, wrong
error messages and so forth).

Anyone else seeing similar things ?

Grtz,

Arthur Donkers
Le Reseau

--
/* Disclaimer :   you hire my skills, not my opinions, those are mine !    */
/* email : arthurat_private    Security    'Me ? I'm not me ! I'm just a   */
/* phone : (+31) 50 549 2701   is not a     computer simulation of me'     */
/* URL http://www.reseau.nl   dirty word      Red Dwarf, First Episode     */

Next message: Thomas Springer: "who's owning this ip?"
Previous message: yousuc: "IIS and Windows NT/2000"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu May 10 2001 - 18:20:56 PDT