On Sun, 28 Jul 2002 23:27:11 -0500 "J. Craig Woods" <[EMAIL PROTECTED]> wrote:
> James Sparenberg wrote: > > > > On the subject of Crackers. Note this IP block owned by ATT > > 12.234.0.0/24 If been getting hit heavily from there by a > > number of compromised M$ boxes. I've alerted ATT but so far > > no answer,(it is Sunday though). So for the moment I'm > > blocking the entire IP block. . It's coming from NJ. See > > the logs snippet below. > > > > Yep, Over the years, I have never heard back from ATT when I > have reported abuse to them. Like so many big cats, they do not > give a shit about you and I. But if you think ATT is loaded with > those crummy M$ boxes running infected IIS crap, check this out: > I started blocking M$ boxes coming from the GTE network. I > started with the CIDR notation you are using "24". The problem > was so pervasive that I now have the entire netblock of ip > addresses being shit-canned at my firewall, i.e. 4.0.0.0/8. You > can bet that put a stop to my logs feeling up with unwanted IIS > crap. Just goes to show you that if you take pride in being a > good SA, you do not work on a M$ server if you can help it.... > > drjung DrJung, If you can claim 5,000 dollars in "lost revenue" due to something like this (and in todays market that isn't very hard) Call the FBI. These guys are REAL serious about helping you. I did once on a smurf attack, that was coming from a bunch of WinServers at Level III ... After two months of the guy I got my Office connection from talking with them they still hadn't done a thing. (On again off again DOS attack) But when the FBI walked in two days after I called them and sent them logs, with warrants to confiscate servers they became very very cooperative. Amazing what the concept of losing 20 servers will do to someones attitude. (Oh and they did find the kid in Texas, going through a bunch of zombies in Argentina an the UK) James > > -- > J. Craig Woods > UNIX/NT Network/System Administration > http://www.trismegistus.net/resume.html > Character is built upon the debris of despair --Emerson > >
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
