From: Alex Holst <a@area51.dk>
To: freebsd-security@freebsd.org
Date: Wed, 13 Jun 2001 20:33:29 +0200
Subject: Re: Odd source IP for a scan
Message-ID: <20010613203329.A13593@area51.dk>
User-Agent: Mutt/1.2.5i
   
Quoting David Goddard (dmg@procopia.com):  
> 66.22.30.76 resolves to host.domain.com - my guess is that it's some
> hacking tool and the script kiddie has not bothered to change the
> spoofing from the default.
  
What's spoofed? Whoever owns 66.22.30.76 has told their DNS server to return
"host.domain.com" when asked for a hostname.

Query about 66.22.30.76 for record types PTR
Name: host.domain.com
Address: 66.22.30.76


-- 
I prefer the dark of the night, after midnight and before four-thirty,
when it's more bare, more hollow.                  http://a.area51.dk/


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message