Re: IIS Logfile

[H Carvey <keydet89 () yahoo com>]

In-Reply-To: <1098740925.417d74bd08f00 () webmail fdta-valles org>


> I understand that some "whois" site is checking my server, but Is this
> dangerous? Should I block this IP?

The returned HTTP response code is 401, indicating an error.  According to TechNet, 401 response codes have to do with 
failures due to unauthorized access.  

Since the query is failing, I'm curious as to how this activity would appear to be dangerous.  Are you seeing something 
else occuring on your server, which may be a result of this log entry?  If so, can you describe it?

Thanks,

Harlan Carvey
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com