Salve io ho il firewall "mcafee firewall 4" che oggi mi ha rilevato e bloccato un attacco da parte di "qualcuno" nel mio pc, tramite port-scan, ed in automatico ha cercato la fonte ed altro, il mio firewall dopo aver rilevato la fonte o cosa sia mi ha dato queste informazioni:
ATTACCO PORT-SCAN 6/10/2004
McAfee Firewall ha bloccato un tentativo di intrusione nel computer
tramite un attacco "Port Scan". L'indirizzo remoto associato al traffico
era 216.35.123.100. La porta remota era 80 [HTTP]. La porta locale sul PC era 4298
[ephemeral]. La scheda di rete per il traffico era
"NIC Fast Ethernet PCI Realtek RTL8139 Family".
I dati binari contenuti nel pacchetto erano
"00 10 dc ab 82 58 00 05 9a 3d 0e 04 08 00 45 00 00 28 0c a6 00 00
ef 06 a9 69 d8 23 7b 64 c0 a8 01 90 00 50 10 ca 4f 92 c3 74 73 73
da 9f 50 11 1f fe 07 e1 00 00 00 00 00 00 00 00 ".
ALTRE INFORMAZIONI + DETTAGLIATE:
ATTACCO DA PARTE DI:
Nome: media.theforce.net
Indirizzo IP: 216.35.123.100
Località: San Jose (37.350N, 121.950W)
Rete: SAVVIS
TITOLARE:
NOTICE AND TERMS OF USE: You are not authorized to access or query our WHOIS
database through the use of high-volume, automated, electronic processes. The
Data in Network Solutions' WHOIS database is provided by Network Solutions for information
purposes only, and to assist persons in obtaining information about or related
to a domain name registration record. Network Solutions does not guarantee its accuracy.
By submitting a WHOIS query, you agree to abide by the following terms of use:
You agree that you may use this Data only for lawful purposes and that under no
circumstances will you use this Data to: (1) allow, enable, or otherwise support
the transmission of mass unsolicited, commercial advertising or solicitations
via e-mail, telephone, or facsimile; or (2) enable high volume, automated,
electronic processes that apply to Network Solutions (or its computer systems). The
compilation, repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of Network Solutions. You agree not to use
high-volume, automated, electronic processes to access or query the WHOIS
database. Network Solutions reserves the right to terminate your access to the WHOIS
database in its sole discretion, including without limitation, for excessive
querying of the WHOIS database or for failure to otherwise abide by this policy.
Network Solutions reserves the right to modify these terms at any time.
Registrant:
TF.N LLC (THEFORCE6-DOM)
904 Brazos Drive
Southlake, TX 76092
US
Domain Name: THEFORCE.NET
Administrative Contact, Technical Contact:
TF.N LLC (KFXKDLNIEO) philip@rebelscum.com
904 Brazos Drive
Southlake, TX 76092
US
2142077355
Record expires on 20-Sep-2005.
Record created on 21-Sep-1997.
Database last updated on 6-Oct-2004 07:31:02 EDT.
Domain servers in listed order:
L4.NSTLD.COM 192.41.162.33
G4.NSTLD.COM 192.42.93.33
A4.NSTLD.COM 192.5.6.33
H4.NSTLD.COM 192.54.112.33
J4.NSTLD.COM 192.48.79.33
F4.NSTLD.COM 192.35.51.33
RETE:
OrgName: Savvis
OrgID: SAVVI-2
Address: 3300 Regency Parkway
City: Cary
StateProv: NC
PostalCode: 27511
Country: US
ReferralServer: rwhois://rwhois.exodus.net:4321/
NetRange: 216.32.0.0 - 216.35.255.255
CIDR: 216.32.0.0/14
NetName: SAVVIS
NetHandle: NET-216-32-0-0-1
Parent: NET-216-0-0-0-0
NetType: Direct Allocation
NameServer: DNS01.SAVVIS.NET
NameServer: DNS02.SAVVIS.NET
NameServer: DNS03.SAVVIS.NET
NameServer: DNS04.SAVVIS.NET
Comment: * Rwhois reassignment information for this block is available at:
Comment: * rwhois.exodus.net 4321
Comment: * For abuse please contact abuse@exodus.net
RegDate: 1998-07-30
Updated: 2004-09-02
OrgAbuseHandle: ABUSE11-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-877-393-7878
OrgAbuseEmail: abuse@savvis.net
OrgNOCHandle: NOC99-ARIN
OrgNOCName: Network Operations Center
OrgNOCPhone: +1-800-213-5127
OrgNOCEmail: ipnoc@savvis.net
OrgTechHandle: UIAA-ARIN
OrgTechName: US IP Address Administration
OrgTechPhone: +1-888-638-6771
OrgTechEmail: ip@cary.savvis.net
ARIN WHOIS database, last updated 2004-10-05 19:10
Enter ? for additional hints on searching ARIN's WHOIS database.
Poi ora dato chè l'attacco è stato fermato, non ho subito danni, ma vorrei saperne di + su questo tipo di attacco, per-esempio:
-cosè un attacco port-scan?
- e gentilmente vorrei capire un pò di + su quello che cè scritto qui sopra, grazie mille.
Sono sicuro che voi siete Molto ma molto + esperti di me, grazie del vostro aiuto
Alessio
Rispondi quotando
