[prev in list] [next in list] [prev in thread] [next in thread] 

List:       incidents
Subject:    RE: Cobalt Scan
From:       Sven Carstens <s.carstens () gmx ! de>
Date:       2001-07-30 9:55:52
[Download RAW message or body]

> Hi there,
> I noticed the IP adress is (probably) the same and it reverses to:
> 
> Name:    ariston.netcraft.com
> Address:  195.92.95.61

I've made the double check and used netcraft to examine one of my servers.
The results are different from the request for cobalt-images seen so far:

wooster.netcraft.com - - [27/Jul/2001:13:07:03 +0200] "HEAD / HTTP/1.1"
 200 0 "http://www.netcraft.com/survey/" "Mozilla/4.0 (compatible; Netcraft Web Server Survey)"
jumble.netcraft.com - - [28/Jul/2001:23:57:51 +0200] "HEAD / HTTP/1.0"
 200 0 "http://www.netcraft.com/survey/" "Mozilla/4.0 (compatible; Netcraft Web Server Survey)"

> Appearantly somebody just used netcraft to see more information about your
> server :)
> So no worries :)

So it isn't the normal probe that everbody can use, but something special.
Speculations about the intended usage of the data are left to the reader.

CU Sven




----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

[prev in list] [next in list] [prev in thread] [next in thread]