   Hacker trace
  This doesn't really have much to do with programming but I don't know where else to put it. It is a plea to the community's knowledge. I've had someone trolling my IP for the last 24 hours, and I can't get rid of them. I think my firewall is stopping them but my average hit rate went from about 100 a day to about 6000 in the last day. Most of the probe's are from the same ten IP numbers. I've looked for an hour and a half on someplace to report hackers but came up with zero. The only sites I find deal with identity theft which hasn't happened yet. Any help would be greatly appreciated.Edit: This edit post dates everything else on the thread. This is definately NOT a spam bot. I just got pingged by my own IP adress. I'm going offline in a minute but a quick response of how I can find out where this is coming from(I have the IPs) and report this abuse back to their ISP, because I don't know who that would be.[Edited by - Ranger50000 on June 7, 2006 3:16:27 PM]
  Run a decent, up-to-date virus scanner over your whole system, or two if you can't find anything. Also try a specialised rootkit revealing tool. If there's nothing to be found, you probably just need to wait until they get bored.~phil;  What do you mean by "trolling your IP"? Someone trying to connect to you? Someone managing to connect to you? What port(s)?   ;  Whois their IP and complain to the listed abuse address as well as your own ISP (which may place the IP on their blacklist or annoy the attacker's ISP for you).   ;Quote:Original post by Ranger50000Quote:Evil SteveWhat do you mean by "trolling your IP"? Someone trying to connect to you? Someone managing to connect to you? What port(s)? Sorry about the vaugeness. Trying to connect to UPD Port 1026 almost exclusivly. And as for managing to connect I don't think they have. My anti-spyware program and Anti Virus didn't find anything but those aren't fool proof.That's just a Windows Message Service spambot. Nothing to be worried about, though if your firewall allows you to just block that IP forevermore and not get any more warnings from it, I recommend doing so.   ;  Or, open that port on your firewall and watch the spam message boxes pop up. It's always fun. Unless you're trying to do something constructive...Slightly off-topic: Did MS not know this was going to happen? Why on earth didn't they make the messenger service only accept LAN IPs? It's easy enough to do...   ;Quote:  RavuyaWhois their IP and complain to the listed abuse address as well as your own ISP (which may place the IP on their blacklist or annoy the attacker's ISP for you). I have no idea who their IP is. As far as my ISP, they didn't even respond to me when I tried to tell them repeatedly that they gave me more channels than I'm paying for, so I doubt they'll respond to this.If it will help here's my log from the past thirty minutes: 204.16.208.113 {UDP Port 36424]204.16.208.113 [UDP Port 36424]204.16.208.113 [UDP Port 36413]204.16.208.111 [UDP Port 53984]204.16.208.111 [UDP Port 48875]204.16.208.111 [UDP Port 48877]204.16.208.107 [UDP Port 39230]204.16.208.107 [UDP Port 39231]204.16.208.107 [UDP Port 39243]204.16.208.107 [UDP Port 39243]204.16.208.107 [UDP Port 39243]204.16.208.197 [UDP Port 39243]204.16.208.107 {UDP Port 39243]204.16.208.102 [UDP Port 35495]204.16.208.102 [UDP Port 38962]204.16.208.102 [UDP Port 38963]204.16.208.102 [UDP Port 38964]204.16.208.106 [UDP Port 58354]204.16.208.106 [UDP Port 58354]204.16.208.106 [UDP Port 58353]204.16.208.106 [UDP Port 58352]204.16.208.102 [UDP Port 39041]204.16.208.102 [UDP Port 39041]204.16.208.102 [UDP Port 39041]204.16.208.101 [UDP Port 56019]204.16.208.101 [UDP Port 59526]204.16.208.75 [UDP Port 36602]204.16.208.60 [UDP Port 47868]204.16.208.60 [UDP Port 34912]204.16.208.60 [UDP Port 53235]204.16.208.59 [UDP Port 58068]202.56.246.246 [UDP Port 4412]202.96.96.205 [UDP Port 2045]166.196.238.124 [UDP Port 45604]57.61.61.63 [UDP Port 13364]57.61.61.63 [UDP Port 13364]205.73.217.233 [UDP Port 0]195.179.19.207 [UDP Port 0]195.179.19.207 [UDP Port 0]80.43.199.143 [UDP Port 0]33.81.206.219 [UDP Port 0]172.138.96.4 [UDP Port 0]3.210.16.6 [UDP Port 0]211.237.79.144 [UDP Port 0]63.146.143.112 [UDP Port 0]215.85.108.67 [UDP Port 0]73.71.129.124 {UDP Port 0]138.113.139.9 [UDP Port 0]87.99.187.4 [UDP Port 0];  This is definately NOT a spam bot. I just got pingged by my own IP address. I'm going offline in a minute but a quick response of how I can find out where this is coming from(I have the IPs) and report this abuse back to their ISP, because I don't know who that would be.   ;Quote:Original post by Evil SteveSlightly off-topic: Did MS not know this was going to happen? Why on earth didn't they make the messenger service only accept LAN IPs? It's easy enough to do...They fixed it in SP2. Someone probably didn't figure that NT machines would be connected unprotected to the Internet when it was under development, so they never bothered to make that feature. And then fast forward a few years, and voila. Happens all the time, I'd bet.You can use whois from the command line or a web based interface to look up the IP and get the abuse address for their ISP.   ;Quote: RavuyaYou can use whois from the command line or a web based interface to look up the IP and get the abuse address for their ISP.Thanks that exactly what I needed to know.   