James Sparenberg wrote: > > On the subject of Crackers. Note this IP block owned by ATT > 12.234.0.0/24 If been getting hit heavily from there by a number > of compromised M$ boxes. I've alerted ATT but so far no answer, > (it is Sunday though). So for the moment I'm blocking the entire > IP block. . It's coming from NJ. See the logs snippet below. >
Yep, Over the years, I have never heard back from ATT when I have reported abuse to them. Like so many big cats, they do not give a shit about you and I. But if you think ATT is loaded with those crummy M$ boxes running infected IIS crap, check this out: I started blocking M$ boxes coming from the GTE network. I started with the CIDR notation you are using "24". The problem was so pervasive that I now have the entire netblock of ip addresses being shit-canned at my firewall, i.e. 4.0.0.0/8. You can bet that put a stop to my logs feeling up with unwanted IIS crap. Just goes to show you that if you take pride in being a good SA, you do not work on a M$ server if you can help it.... drjung -- J. Craig Woods UNIX/NT Network/System Administration http://www.trismegistus.net/resume.html Character is built upon the debris of despair --Emerson
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
