General Discussions

**ozecho** · 02-10-2010, 01:25 PM

I have a site that is being 'attacked'. They created a user (actually lots of users) which I have managed to stop and block the existing users.

However, when they tried to login last night, and they got failures (because they were blocked) in the space of a minute, their 13 attempts came from the following 13 different IP addresses from around the world.

"82.150.165.146"
"200.195.137.163"
"187.4.128.11"
"195.70.145.15"
"122.252.242.4"
"202.133.60.189"
"87.248.172.134"
"201.42.171.227"
"221.9.255.117"
"189.41.197.210"
"110.138.247.27"
"194.145.159.163"
"156.17.125.123"

They all turn out to be "proxy" servers, but how are the hackers changing the proxy servers so quickly.

any ideas?

**chrishirst** · 02-10-2010, 02:24 PM

Because they are not "users". It's a script.

**Lemonie** · 02-10-2010, 02:51 PM

ehh this remind me about my pc got attack from several IP too. i dont know much about this but its seem my McAfee help to handle it

what we should do if got attack like that?
is that true antivirus can blocked it?

**chrishirst** · 02-10-2010, 03:05 PM

Quote:

what we should do if got attack like that?
is that true antivirus can blocked it?

Not much you can do, apart from make sure all ports are blocked for incoming traffic other than the ones you actually need open.

Antivirus will only be able to block "attacks" that it "knows" about or ones that have a malware "footprint"

**TG12** · 02-23-2010, 09:09 AM

On my FTP server whenever an IP "trys" to attack it I use IPNetInfo to find out where they are then run a scan using NMap to see what ports are open. Generally if you see port 3389 open you can use Remote Desktop to get onto the box. 25 is usually a Mail Relay. 22 is SSH (Linux Box). I find it quite interesting to see whats out there . . .

**TG12** · 02-23-2010, 01:14 PM

Here are the details for the ranges of IP's you posted. The first one is a linux box with all sorts of services running . . .