venuscat2
Posts: 461
Joined: Fri Sep 08, 2000 1:44 am

Computer Attack Attempts

Mon Sep 22, 2003 5:48 am

I just installed Norton Personal Firewall on my computer. So far, in the ten minutes or so that I've been online, it says that there have been 93 attack attempts. Most of them come from IP addresss 204.152.184.80 , which belonges to the Internet Software Consortium in Redwood City, CA. I took a look at their website (http://www.isc.org), and it looks legitimate. Why then, am I getting hacking attempts from this IP?

Thanks.

Jordan
 
bobrayner
Posts: 2038
Joined: Sun Apr 27, 2003 8:03 am

RE: Computer Attack Attempts

Mon Sep 22, 2003 6:03 am

1. Norton might be assuming that something is hostile, when it isn't;
2. Somebody might be spoofing the source address.

204.152.184.80 resolves to kechara.sorcery.net.
If this is hostile traffic, and really from that address, it's probably from some random geek with a shell account on that machine - not necessarily from the owner.

Do you have a log?

What flavour of Windows are you using?


[Edited 2003-09-21 23:04:10]
Cunning linguist
 
cba
Posts: 4228
Joined: Sat Jul 15, 2000 2:02 pm

RE: Computer Attack Attempts

Mon Sep 22, 2003 7:26 am

A lot of these are false alarms.
 
Staffan
Posts: 3879
Joined: Tue Mar 18, 2008 9:21 am

RE: Computer Attack Attempts

Mon Sep 22, 2003 8:11 am

What you should be looking for is port scanning, ie, the same IP trying to connect to your computer through many different ports. If it's the same port every time, in many cases you can find out what kind of activity it is.

 
venuscat2
Posts: 461
Joined: Fri Sep 08, 2000 1:44 am

RE: Computer Attack Attempts

Tue Sep 23, 2003 11:33 am

1. What is a log
2. I am using Windows 98 on that machine
3. It said that there were like 30 attack attempts every time I tried to log into sorcery (the IRC server). I'm not sure, however, how to determine what port(s) it was trying.

I also had on another machine (running windows XP) an alert saying that an IP address belonging to AOL tried to attack the computer when I dialed into Compuserve. (Seeing as Compuserve is an AOL company, I think there might be some kind of relationship with the fact that I was connecting to Compuserve). I haven't gotten that alert any other time I connected to Compuserve, though.

Who is online

Users browsing this forum: GrahamHill, Mani87 and 9 guests