Re: Reporting hacking

["Alexei Pytel" <pytel@xxxxxxxxxx>]

Just for the record - Romania does not use Cyrillic alphabet.

    Alexei Pytel





                    rob@dekko.com
                    Sent by:                  To:     midrange-l@midrange.com
                    midrange-l-admin@mi       cc:
                    drange.com                Subject:     Reporting hacking


                    08/27/2001 05:02 PM
                    Please respond to
                    midrange-l






Is there a channel to report hacking?

My boss is enamored with Op's Nav performance monitoring.  He happened to
notice that the FTP jobs on our web server 400 were eating up some CPU
percentage.  Not much, but some.  We were getting ready to do a ftp site
but not prime time yet.  We fired up our Pentasafe reports and determined
that a certain IP address was trying to probe us for ftp.  Pentasafe was
slamming the door on them.  We decided to try to access that ip address
from one of our browsers and got a Romanian pharmaceutical company.
(Although I am not too good on my Cyrillic alphabet).

Since our ftp is not prime time yet, we changed our firewall to block all
external ftp for now.  Basically as a defense in depth, and to take a load
off of the 400.  We thought about just blocking this IP address:
212.93.151.182

Rob Berendt

==================
A smart person learns from their mistakes,
but a wise person learns from OTHER peoples mistakes.

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com