I'm not getting attacked from this alter.net IP, but I am being constantly scanned on consecutive ports usually ranging in the 21xx or 24xx range. My firewall (a windows based firewall/proxy ap on an NT4 server) blocks both of these ranges, so all I see are requests on port 21xx and each is denied. There are 3 separate IP addresses doing this, but they are one after the other scanning ports in consecutive order. Anyone ever seen anything like this? > You are not alone, I've also been attacked by someone from this > alter.net site. Do a google search for alter.net and you should find > more information. > > From my searches, alter.net is a small? ISP in BC canada... > > > On Wed, 29 Nov 2000 22:17:42 -0800, you wrote: > > >There is an ip number that started showing up in my postfix logs > >as trying to access my smtp server (and access was apparently > >denied each time). I assumed that someone was trying to use > >my machine as a relay. To make sure that they can't get through, > >I blocked the ip address using ipchains. In one day, I now > >see over 600 failed attempts to access my computer. Should I > >just ignore this now that ipchains is blocking them, or is this > >something that should worry me. > > > >More details: > >ipchains message (my ip # x-ed out to protect the innocent): > >Nov 28 23:59:07 duck kernel: Packet log: input DENY eth1 PROTO=1 > >63.98.105.3:8 208.xxx.xxx.xx1:0 L=60 S=0x00 I=6793 F=0x0000 T=114 (#1) > > > >nslookup for 63.98.105.3 gives nothing. > >traceroute ends at readersdigest-gw.customer.alter.net (157.130.210.42) > > > There's plenty of semicolons to go around
Keep in touch with http://mandrakeforum.com: Subscribe the "[EMAIL PROTECTED]" mailing list.
Keep in touch with http://mandrakeforum.com: Subscribe the "[EMAIL PROTECTED]" mailing list.
