RE: HTTP Probe by Webserver

From: Vince Sola (sola-vat_private)
Date: Wed Oct 10 2001 - 16:52:45 PDT

Next message: James Willmore: "Re: Port 17889 - new attack?"

Previous message: Dean Cunningham: "RE: HTTP Probe by Webserver"
In reply to: Alan Wright: "HTTP Probe by Webserver"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

That host has been had by the Nimda worm..so you may just be seeing nimda 
probes.

Vince

> -----Original Message-----
> From: Alan Wright [mailto:AlanJWrightat_private]
> Sent: Wednesday, October 10, 2001 6:31 PM
> To: incidentsat_private
> Subject: HTTP Probe by Webserver
> 
> 
> Dear All
> 
> I have noticed tonight that BlackIce Defender has flagged up 
> an Http probe 
> from a webserver @195.10.146.197.
> This comes back as a Finnish IP.
> Anyone know if the server has been compromised and is 
> randomly probing or 
> is someone using it as a jump off point for some probing
> 
> Any help would be gratefully received.
> 
> 
> 
> All the best
> 
> Alan
> 
> { Alan J Wright B.Sc(Hons)(Open)}
> {SMS or Phone +447624462772}
> 
> 
> 
> --------------------------------------------------------------
> --------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management 
> and tracking system please see: http://aris.securityfocus.com
> 

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: James Willmore: "Re: Port 17889 - new attack?"
Previous message: Dean Cunningham: "RE: HTTP Probe by Webserver"
In reply to: Alan Wright: "HTTP Probe by Webserver"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Oct 11 2001 - 08:55:40 PDT