Printable View
I have blackIce and this site eurus.ddfplus.com (208.169.221.47) has scaned me, and keeps on scaning me the count is at right now 918...I ping the site..its not there..I googled the site to see what it is..its not there...so I'm just kinda wondering whats going on?
A log sample could help determine the nature of the event...
Ammo
Contact them and ask them what the hell's going on on their network. They look like a pretty small ISP from what I can tell. Good luck :).
Registrant:
ddfplus, llc (DDFPLUS2-DOM)
330 S WELLS ST STE 1114
CHICAGO, IL 60606-7104
US
Domain Name: DDFPLUS.COM
Administrative Contact:
ddfplus, llc (L17971-OR) [email protected]
ddfplus, llc
330 S WELLS ST STE 1114
CHICAGO, IL 60606-7104
US
312-939-3022 fax: 312-939-4135
Technical Contact:
VeriSign, Inc. (HOST-ORG) [email protected]
VeriSign, Inc.
21355 Ridgetop Circle
Dulles, VA 20166
US
1-888-642-9675
Fax- - [email protected]
Record expires on 09-Apr-2003.
Record created on 09-Apr-2001.
Database last updated on 28-Apr-2002 22:52:03 EDT.
Domain servers in listed order:
NS1.BARCHART.COM 208.169.221.5
NS2.BARCHART.COM 208.169.221.6
well the evidnce log I have i can't decode cuz I don't have the software to so what could i give a that would help?
thanks for the info smirc, lol i have 3100 probe attempts so far from them, did u do a Whols on them to get that info? I went to there site www.ddfplus.com and got there some info (go it from google, entered data wrong :) ) Anyway I got to get some sleep I blocked the IP but I'm still login so when I wake up I wonder how many atempts there will be? also I e-mail some at the site so maybe i will have a response.
Yeah just a plain old whois. I say give them a call and say that someone is scanning you. Since they are scanning you repeatedly this is a kind of attempted DOS. Port scanning isn't illegal but DOS attacks definitely are. In any case you don't have to put up with this.
Ring the number and ask to speak to the senior network engineer in charge of security. Act like you mean business and that you're really pissed off that this kiddie is wasting your time and you want something done about it. Be firm and polite and see what happens.
Now go kick some kiddie ass! :)
lol yeah I will do that but it will have to wait till tommrow after I get home from school, got to wake up at 6 am :(. Thanks for the help though, you should see just how many kiddies scan me a day..but this really make me mad, there taken up my bandwidth and i only have a 56k...well i know i can just log of but I have to d/l files at night and I;m interested in seeing where this goes..well I'm off to bed later
Oop...,Mucolaca you mishap being scan y the website happened to me before.Well,my advise to you this website will never stop scanning your port cos they have in fact get into your temporary internet files or cookie trojan file which is unable to scan by antivirus software.The best for you to do is either get a hardware firewall to block all these ports scans or install a router to trick the hacker website.If you need any more help,feel free to write to me [email protected]
Dump the Blackice,and get Zonealarm.Blackice doest stop outgoing traffic,Zone does.Zonealarm Pro will tell you if its a sniff for trojans and if one n your machine tried to reply.....If you run windows XP or 2000 you can use Packetmon,(from AnalogX) to see what exactly the traffic is about.......The free Zonealarm 2.6 will also stop outgoing traffic but wont give as much info..
this site belongs to the rewarding field of 'Market Research'
04/28/02 23:40:28 Browsing http://ddfplus.com/
Fetching http://ddfplus.com/ ...
GET / HTTP/1.1
Host: ddfplus.com
Connection: close
User-Agent: Sam Spade 1.14
HTTP/1.1 200 OK
Date: Mon, 29 Apr 2002 03:41:42 GMT
Server: Apache/1.3.22 (Win32)
Last-Modified: Wed, 27 Feb 2002 21:18:41 GMT
ETag: "0-598-3c7d4d31"
Accept-Ranges: bytes
Content-Length: 1432
Connection: close
Content-Type: text/html
<HTML>
<HEAD>
<TITLE>ddfplus, llc. - Intelligent Market Data</TITLE>
ZoneAlarm has a table you can enter IP's or whatever other identifiers you want to block. :D
Stop using the zonealarm and blckice defender cos both of them having software bugs.Zonelarm is a lousy firewall which is often prone to attack.It cannot block Dos attack if someone start to ping their system and forcing it to shut down or function adnormally.At least this firewall is still the best which i tried for so many over a years of testing.Best of all it's free and i must tell you that do not install more than 1 firewalls else it will be very unstable for the system an even more prone to attack and pings.Get it here and follow the link http://www.agnitum.com
I think others have already echoed this (though I honestly haven't read through every post in complete detail), but if you're going to complain about someone scaning you, you should at least post "sanitized" versions of the logs indicating the scan so people can help you decipher it.
In the case of UDP, there are plenty of really noisy/chatty pseudo-legitimate protocols out there (DNS, traceroute just to name two). Furthermore, BlackICE has been notorious for running in promiscuous mode and reporting scans/traffic destined for another host or address - without looking at the logfiles, there's no real way to tell what it's reporting and why...
You should look at the logs and make sure that the destination address is your machine (rather than it being the source, or not being included in the alert at all).
This machine, BTW, would seem like a supporting webserver for www.ddfplus.com.
(BTW, wacky_sung, all software/firewall have bugs... I'd be suspicious of any firewall system that didn't "have bugs" - figuring it wasn't respected enough or utlized well-enough to have anyone care about it enough to beat on it)
thanks for the help, but like I said earlyer the only log file I have of the attack is in some kind of format that I can't decode. Its in *.enc. So I don't know what software would do this I will look it up later to find something. if ya want I could just snap a screen shot of my blackIce w/ the attacks in it to improvise? Also this morning I saw that there was a total of more then 20200 scans, but I also have to say that I have pretty much everything sealed up tight on this box so the secutiy is pretty good (as good as it gets for windows:)) so actulay all of the scan attempts were blocked w/out the help of blackice.
Well, if you would take the time to have read the FAQ on the BlackICE site, you might have noticed that the *.enc files from BlackICE will be read... (drum roll please) ...by a sniffing or packet capturing device! Wow!!! (*sighs quietly*) :rolleyes:
So, basically, you can take those evidence files and hand them to any serious network security type and they can put it right in their sniffer (or a software equivalent thereof (like Ethereal or similiar)) and look right at the actual packets.
Amazing how that works, I tell ya... (j/k) :D
I believe there is also a CSV file there, or something, that should give you a very similiar set of output... think it's the overall logfile, though I forget what that's called (though I think it's smart enough to rotate it and trim off the top of the file so as to not fill up your hard drive).
It's been a long while since I've used BlackICE, myself... personally we sh*t-canned a corporate project involving them when we couldn't stop getting false reports (or even promiscuous reports) from it. To their credit, that was way back in the days when they were still mostly still just getting off the ground...
it's just an advertisement, don't bother yourself...probably a ping looking for a potential user...
http://ddfplus.com/overview.asp
Ouroboros
a lil late there draziw, that day I *amazingly* found that out. See I have this thing called school, I posted that i think about 12:00 am then woke up at 6:00am for another post, then got to school at 8:00am and found that out. By the time I got home (3:00pm) I figuered it out and no one else had answered my post so I just forgot about it. i was also a lil peroniod being tiered and all, but I figuered everything out so it ok.
LOL... sorry 'bout that...
Good t'hear you figured it out. Though, if you could post sanitized versions of the logs, I'm sure many here would appreciate it and could be a good "learning process" to add to a tutorial somwhere.
lol its cool I will next time I have a problem like this