Posted: 4/25/2005 4:34:25 PM EDT
|
I have had every possible port scanned and entry attempted today....in 10 hours or so, that is now approaching 9000 attempts. I traced this to the Boston area...but there is no ISP, phone number...and there's a good chance this attack is simply running through Boston as opposed to actually occuring there. With an IP address, what else can I do? Since I've been typing this, there have been 12 more attempts. I've put a block on the IP address, so I don't believe they've been successful...but this is really getting annoying. Is there a way I can stick it to them? I contacted my ISP, but their "solution" started and stopped with a "Do not reply to this email" email....telling me they'd see what they can do. That was this morning. 3000+ attempts later, nothing. |
|
chk out one of these programs find out the isp of the number and give em a call here |
|
Are they coming from the same IP block? Are you null routing IP's as they attempt to port scan you? arin.net/ Use ARIN to lookup who the IP space belongs to. Email the block owner or null route the whole block if enough attempts from the same IP space warrant it. GET A LIVE PERSON ON THE PHONE FROM YOUR ISP. If they aren't handling this like it's important to them, then i would seriously suggest moving ISP's. |
|
Search results for: 69.45.79.136 Williams Communications, Incorporated WCG-BLK-4 (NET-69-44-0-0-1) 69.44.0.0 - 69.45.255.255 Akamai Technologies, Inc. WLCO-TWC02115509-AKAMAI-TECH-MIAMI (NET-69-45-79-0-1) 69.45.79.0 - 69.45.79.255 # ARIN WHOIS database, last updated 2005-04-24 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database. |
and corrected it 
. The one in red is the one, as you're probably aware.
They are both the same. |
|
M4, How are you seeing this attack? Is your PC's firewall seeing it or do you have some sort of hardware router/firewall between you and the internet? If you have a hardware firewall, you can tell it not to respond to port scans or any other ICMP traffic from outside. This is an easy way to black hole yourself from ports scans and such. Like some others have said, chances are, some machine ahs been 'zombied' and is scanning yours and many other addresses. Let the ISP know, as they can alert the customer and maybe fix it. Keep us posted. |
