[suse-security] Re: access from strange IP-address

[Markus Gaugusch <markus@xxxxxxxxxxx>]

On Jan 12, Markus Gerke <gerke@xxxxxxxxxxxxxxxxxxx> wrote:

> Hello everybody,
> today someone accessed my apache-server from 141.201.152.145 . the
> ns-entry is work-mm. (see below). Does someone know, why the
> toplevel-domain is missing in this name?
>
> Regards,
> Markus
>
> nslookup 141.201.152.145
> Server:         130.75.1.32
> Address:        130.75.1.32#53
>
> Non-authoritative answer:
> 145.152.201.141.in-addr.arpa    name = work-mm.

Because the owner put junk into the PTR record for his IP.
Of course, no forward-lookup of this name is possible.

Markus
--
__________________    /"\
Markus Gaugusch       \ /    ASCII Ribbon Campaign
markus(at)gaugusch.at  X     Against HTML Mail
                      / \

--
Check the headers for your unsubscription address
For additional commands, e-mail: suse-security-help@xxxxxxxx
Security-related bug reports go to security@xxxxxxx, not here