[Emerging-Sigs] CPAN.ORG on list

Matthew Jonkman jonkman at emergingthreatspro.com
Wed Oct 26 15:18:32 EDT 2011


We do have 212.117.160.0/19 in the RBN nets, and it's been there a good while. 

For cpan.org I get 199.15.176.140 currently, which isn't in that range, but I imagine they're doing some geo-ip.

Has anyone else seen this?

There is a cpan.org at that IP if you browse by IP. Interesting that this just came up though.

Matt

On Oct 26, 2011, at 3:07 PM, waldo kitty wrote:

> On 10/26/2011 14:52, Kevin Ross wrote:
>> No idea which list it is on as I am importing dhsield, RBN, botcnc, ciarmy,
>> compromised into pfsense aliases and doing inbound & outbound blocking but
>> cpan.org <http://cpan.org> is being blocked 212.117.177.118. Why? Need to create
>> myself an ACL above block rules now :( lol
> 
> i don't find that IP in any of the ET or SF rules on my smoothie...
> 
> grep -i -E "212\.117\.177\.118" *basepath*/snort/*/*.rules
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 
> Support Emerging Threats! Subscribe to Emerging Threats Pro http://www.emergingthreatspro.com
> The ONLY place to get complete premium rulesets for Snort 2.4.0 through Current!


----------------------------------------------------
Matt Jonkman
Emerging Threats Pro
Open Information Security Foundation (OISF)
Phone 866-504-2523 x110
http://www.emergingthreatspro.com
http://www.openinfosecfoundation.org
----------------------------------------------------



More information about the Emerging-sigs mailing list