Security Incidents mailing list archives

Re: Microsoft version.binding us now?

From: Erich.Meier () INFORMATIK UNI-ERLANGEN DE (Erich Meier)
Date: Mon, 29 May 2000 15:02:20 +0200


On Fri, May 26, 2000 at 07:11:36PM -0500, Bill Marquette wrote:

I've seen the following scan on some servers I admin for the last few days
from not only 207.46.106.84 but also a couple other systems in that /24
address space.  So far I've seen the version.bind hits about 50 times.  The


Exactly the same here. Always polling one of my nameservers from 208.184.4.142
or 207.46.106.76 addresses.

No idea what they're trying to achieve.

Erich

--
Erich Meier                              Erich.Meier () informatik uni-erlangen de
                                 http://www4.informatik.uni-erlangen.de/~meier/

Current thread:

Spoofed ICMP "destination unreachable" - DOS? Ken Eichman (May 22)
- Microsoft version.binding us now? Bill Marquette (May 26)
  - New DoS attack Jeff Calvert (May 28)
  - Re: Microsoft version.binding us now? Erich Meier (May 29)
- Re: Spoofed ICMP Richard Bejtlich (May 27)
- Re: Spoofed ICMP "destination unreachable" - DOS? Steve Reid (May 27)
- <Possible follow-ups>
- Re: Spoofed ICMP "destination unreachable" - DOS? Aussie (May 24)
  - ICMP attack in progress? Lic. Rodolfo Gonzalez Gonzalez (May 25)
    - Re: ICMP attack in progress? Crist J. Clark (May 25)
    - Re: ICMP attack in progress? Jason Storm (May 26)
  - afs3 exploit?? elijah wright (May 25)
    - Strange Happenings @Home Fred Hirsch (May 30)
  - AMDROCKS Jim Williams (May 25)
    - Attacks on port 25 Vincent Lim (May 25)

(Thread continues...)