Re: Another incident of hack attempts from a Chinese host

From: semat (sematat_private)
Date: Tue Apr 24 2001 - 09:29:03 PDT

  • Next message: Majid Almassari: "Re: attachment; filename="photo1.jpg.pif""

    > > My response is:
    >
    > > "You're the only contact I can find.  Please forward my report on to
    > > whoever it is that's actually responsible for that host and make sure
    > > that they take heed.  If you don't, you'll just keep getting reports
    > > about this, as there's no way for anybody to contact anyone but you".
    >
    > > For the most part, though, they just never respond at all.
     I totally agree with Michael. I do not run a netblock or anything of the
    sort. However I had machine that used to be a nat proxy and it stopped but
    some script kiddie on my network who for obvious reasons did not want to
    be traced decided to scan an entire class A for port 111 and also
    accompany his scans with a script to try and exploit the servers that were
    vulnerable. Now obviously I did not know this till the next morning when I
    got in and on discovering this I traced the activity back to the source,
    disconnected the kiddie's machine and gave him a long reprimand on such
    behaviour.
    	Now of all the admins that contacted me from those hosts. I can
    tell you that those that were polite almost immediately received a
    response from me to the effect that we're very sorry and that the matter
    has been dealt with and will not occur again however the rude ones did not
    get an answer back and will probably post to some list somewhere
    complaining about unhelpful admins.
    



    This archive was generated by hypermail 2b30 : Tue Apr 24 2001 - 10:08:35 PDT