Re: CRv2 multiple scans from same source IP

From: Luc Pardon (lucpat_private)
Date: Sun Aug 05 2001 - 20:02:05 PDT

  • Next message: Chris Freeze: "Re: CRv2 multiple scans from same source IP" 

      Maybe this is just three systems behind the same proxy ? Not untypical
for cable ISP's. 

  If so, I'd report this to the ISP, they usually don't like their
customers running web servers. 

  Luc Pardon
  Skopos Consulting
  Belgium



John Davidson wrote:
> 
> My W2k IIS logs show 3 CRv2 scans from the same source IP within the same
> minute.
> 
> The IP is outside my Class A address space. From the analysis of CRv2
> published at www.eeye.com this should not be possible, or at least the
> likelihood of such an occurence is much greater than winning a very big
> lottery... I should maybe buy a ticket! ;-).
> 
> John Davidson
>

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

    This archive was generated by hypermail 2b30 : Sun Aug 05 2001 - 20:20:27 PDT