Re: CRv2 multiple scans from same source IP

[Luc Pardon <lucp () skopos be>]

  Maybe this is just three systems behind the same proxy ? Not untypical
for cable ISP's. 

  If so, I'd report this to the ISP, they usually don't like their
customers running web servers. 

  Luc Pardon
  Skopos Consulting
  Belgium



John Davidson wrote:
> My W2k IIS logs show 3 CRv2 scans from the same source IP within the same
> minute.
>
> The IP is outside my Class A address space. From the analysis of CRv2
> published at www.eeye.com this should not be possible, or at least the
> likelihood of such an occurence is much greater than winning a very big
> lottery... I should maybe buy a ticket! ;-).
>
> John Davidson

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com