full-disclosure - Re: lots of connections to 64.40.117.19 port 80

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4e324cb0804181020q49a5e140y869fcd953f3ef51a@mail.gmail.com>
Date: Fri, 18 Apr 2008 18:20:18 +0100
From: mcwidget <mcwidget@...il.com>
To: offbitz <offbitz@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: lots of connections to 64.40.117.19 port 80

>
>      I would assume the first sentence means you are seeing outgoing
> connections, from your client's site, destined for the IP/port above.  So
> then, the second sentence makes even less sense, connections coming into
> your network from all over the Internet, but 'specifically to this IP'?
> Huh?  Maybe I just need more coffee, but please explain this one for me.
>

I think what he's saying is that the IP address listed belongs to one of his
clients and they are receiving connections to port 80 on that IP from all
over the internet; and asking why this would be happening.

The obvious answer is because a process running on that IP is listening on
that port.  Really, any more detailed description than that, even confirming
it's serving a website, is gonna require some packet grabs or info on the
process listening on that port.  Or both.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/