The Russians are attacking my network. :)

I was looking through the logs of the attack blocker that we use today. The software suite is called Untangle [v5.3]. It is a sort of all in one web filter/firewall/spamblocker etc.

I saw an outside IP address that was being picked up. 83.102.190.246 I checked the hostname which is: icvector-gw.corbina.net. hcidata.info reported the country to be: Russian Federation.

Untangle gave the attack a reputation ranging from 60-67. Unfortunately, Untangle is pretty limited in reporting. It does not tell me what kind of attack was detected. So I don't know if this was just a portscan, or an attempted DoS, etc.

Has anyone here seen this hostname in their logs?

Sorry that I don't have more details.

Should I just ignore this? Block the IP range? [it is a school network, and we don't have any Russian Foreign exchange students that I know of :)]

Should I start watching for students wearing excessive red to school? :shocked: :D

Does the logs tell you anything other then this IP attacked you?

If it was a web attack there should be something in the webserver's logs.
If it was some portscan the firewall logs should show that.

When none of this is available you need to seriously consider using some other software. If you can't do even the most basic correlation or investigation, the software is crap.

I get "attacked" all the time, from all over the world, not just the Russian Federation. My logs tell me exactly what's going on.

I agree wholeheartedly with SirDice, that is some pretty useless software you have.

If it can't tell you what is going on, how do you expect to protect yourself.

Get rid of that software first--get something useable (I'm sure SirDice has some good recommendations).

I'll look up that domain name and see if I can find anything.

Seriously, there are lots of good security suites out there for good prices and many opensource like untangle

edit: corbina.net seems fine, but it is common practice to block china, russia, etc... think about the tradeoffs of doing so (is it worth risking attack for an ip range that will probably never be needed on your network)

My recommendation: block it

Edit: find another product--there are plenty out there