Re: Suspiscious entries in the ISA 2000 Log



Just an Exchange 2k3 server. We do not host a website in house? I am afraid
that we are exposed somehow.

"ZVR" wrote:

> I don't see anything wrong with your log. Just some anonymous connections to
> a web server published through your ISA... you do have a web server
> published for the outside world, right?
>
> Virgil
>
>
>
> "COB" <COB@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:6F3253C5-8C1D-463C-923B-EF379B79ADEC@xxxxxxxxxxxxxxxx
> > Not sure what this is but I am concerned. When looking at the log files,
> > we
> > have always seen just the internal private ip address. Last week, we had
> > entries that didnt belong and we are not sure what they are doing there.
> > Is
> > there a simple explanation for this? FYI (24.x.x.x is our outside ip
> > address
> > COPS is our ISA server name). The first 2 entires are cable companies - 1
> > of
> > who we use, but the other is from China. Why do we see entries in the log
> > that are outside our private network?
> >
> > 24.121.122.146 anonymous 2005-08-19 00:28:50 W3ReverseProxy COPS -
> > 24.x.x.x
> > - - - 5697 - - TCP GET http://24.x.x.x/ - - 12202 0x8
> >
> > 24.240.242.199 anonymous 2005-08-19 01:56:03 W3ReverseProxy COPS -
> > 24.x.x.x
> > - - - 5697 - - TCP GET http://24.x.x.x/ - - 12202 0x8
> >
> > 211.98.186.199 anonymous 2005-08-19 08:43:21 W3ReverseProxy COPS -
> > 24.x.x.x
> > - - - 5697 - - TCP GET http://24.x.x.x/ - - 12202 0x8
> >
>
>
>
.