[Snort-users] porn.rules

Paul Melson pmelson at ...11827...
Fri Nov 9 10:36:26 EST 2007


> Im seeing a connection to  PORN masturbation site.  However the source
address 
> 74.205.54.243:80 doesnt resolve.  Does anyone know what this address is?
dnsstuff.com says 
> it belongs to rackspace.com, Im thinking rackspace probably rents server
space for domains?

Webhosting.info says it's diceext.com.
http://whois.webhosting.info/74.205.54.243

I don't find any other domains using that IP, so that's probably accurate.
Are you proxying web traffic through anything like ISA Server or Squid?  If
so, you'll have the fqdn in a log file somewhere.

PaulM





More information about the Snort-users mailing list