Microsofts IIS 5.0/5.1/6.0 Web servers seem to disclose their internal ip, when giving
a 401 HTTP response take a loook.

[11:05 PM ~]#nc -vv 127.0.0.1 267
localhost [127.0.0.1] 267 (?) open
OPTIONS / HTTP/1.0


HTTP/1.1 401 Unauthorized
Content-Length: 1656
Content-Type: text/html
Server: Microsoft-IIS/6.0
WWW-Authenticate: Basic realm="172.20.0.79"
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Date: Sun, 06 Nov 2005 17:39:09 GMT
Connection: close

The basic realm is set to the internal IP

NOTE: Don't fret on the port 267 thing, the whole thing is through sslproxy.