DOS from 196-210-23*-*.dynamic.isadsl.co.za

Yo,
I'm continuously getting DOS attacks from this server located Bryanstan

TCP Packet - Source:196.210.23*.*,1225 Destination:192.168.0.50,80 - [DOS]
.
.
.
*snip*

I am itching to b0ll0cks up that server , as 3389 is open and i just rdesktop'd to it grrrrrr :twisted: will i get into ****e as this is now cheesing me off.

[root@ninja home]# nmap 196.210.23*.*
Starting Nmap 5.21 ( http://nmap.org ) at 2012-01-25 14:05 SAST
Nmap scan report for 196-210-23*-*.dynamic.isadsl.co.za (196.210.23*.*)
Host is up (0.096s latency).
Not shown: 989 filtered ports
PORT STATE SERVICE
21/tcp closed ftp
23/tcp closed telnet
25/tcp open smtp
80/tcp open http
110/tcp open pop3
113/tcp closed auth
143/tcp closed imap
443/tcp open https
1723/tcp open pptp
3389/tcp open ms-term-serv
60443/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 16.51 seconds

Not necessarily a server. More likely someone's home windows machine complete with trojan
Report to IS abuse dept, let them deal with it.

urhm, well, M$ 2003 srv and local domain is business....

Sinbad, you no fun

Share the IP? (including last digit)

I've been experiencing very slow local sites and some international access issues from last night. Seems like there might be some routing issues with afrihost / webafrica.

Sinbad said:

Report to IS abuse dept, let them deal with it.

Click to expand...

+1