RE: 'nother question --


Subject: RE: 'nother question --
jsaam@mcc-cpa.com
Date: Mon Oct 29 2001 - 10:44:14 AKST


Yeah -- I did the whois, and found registrant info. Appears that one of
them is a default setup of IIS 4, and the other is Default IIS 5.0 on Win2k.
I went to http:// ip address>, and based on the web content that comes
up, you can pretty much make an educated guess... now, who should I call @
telAlaska? :) (jk.. I know just who to call)

-----Original Message-----
From: Greg Jetter [mailto:greg@lazymountain.com]
Sent: Friday, October 26, 2001 7:30 PM
To: Jon Saam; aklug@aklug.org
Subject: Re: 'nother question --

On Friday 26 October 2001 04:37 pm, you wrote:
> How can I find out who is hosting a webserver with a given IP? I want to
> know who it is that is infected with the code red thing here, and is
> attempting to infect my web server.

try whois command or nslookup to start to locate the people then check
their
redgstrar record to see the contact name and address information.

I also have seen quit a few attacks from spoofed IP's comming at my web
server , when I backed traced them found out that the IP's realy did not
exest. Just think of the fun when XP is in wide use and all the D.O.S.
attacks begin ..... Oh well sometimes people need to be hit over the head
with a hammer befor they get the message.... good luck

I'm sure there is a better way and some one on the list will chime in with
it but it works for me.

Greg



This archive was generated by hypermail 2a23 : Mon Oct 29 2001 - 10:45:35 AKST