denial of service incoming gescant door sygate! Wat te doen?

[Verwijderd]

Nou kreeg ik net dit door twee verschillende UPC adressen ...

Wat moet ik daarmee en wat is het? Ik heb wel is poortscan, maar das niet erg toch>?

Hoofdscherm:



-------------------


En dan de WHOIS:

IP: 10.92.0.1

IANA (RESERVED-6)
Internet Assigned Numbers Authority
4676 Admiralty Way, Suite 330
Marina del Rey, CA 90292-6695
US

Netname: RESERVED-10
Netblock: 10.0.0.0 - 10.255.255.255

Coordinator:
Internet Corporation for Assigned Names and Numbers (IANA-ARIN) [e-mail]
[phone]

Domain System inverse mapping provided by:

BLACKHOLE-1.IANA.ORG 192.0.32.18
BLACKHOLE-2.IANA.ORG 192.0.32.19

These blocks are reserved for special purposes.
Please see RFC 1918 for additional information.

Record last updated on 12-Oct-2001.
Database last updated on 23-Aug-2002 16:56:03 EDT.
The information in this WHOIS database is current as of August 23, 2002,
and has been retained for historical purposes only. For the most current
information, query whois.arin.net or visit http://whois.arin.net.

-------------------

IP: 212.142.21.103 name: p21103.net.upc.nl

% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html

inetnum: 212.142.20.0 - 212.142.23.255
netname: TK-NIJ-1
descr: Telekabel Nijmegen
descr: cablemodem block 1
country: NL
admin-c: UCR1-RIPE
admin-c: EIAR1-RIPE
tech-c: UCR1-RIPE
tech-c: EITR1-RIPE
status: ASSIGNED PA
notify: [e-mail]
mnt-by: UPCNL-MNT
changed: [e-mail] 19990210
changed: [e-mail] 20000731
changed: [e-mail] 20021121
source: RIPE

route: 212.142.0.0/18
descr: UPC.nl Network Services
descr: Priority Business Customers
descr: The Netherlands
origin: AS8209
notify: [e-mail]
mnt-by: UPCNL-MNT
changed: [e-mail] 20001127
source: RIPE

role: UPC-NL Contact Role
address: Galvanistraat 12-2
address: 6716 AE Ede
address: The Netherlands
phone: [phone]
fax-no: [phone]
e-mail: [e-mail]
admin-c: RIHU1-RIPE
admin-c: RC482-RIPE
tech-c: RIHU1-RIPE
tech-c: EJ21-RIPE
tech-c: RC482-RIPE
nic-hdl: UCR1-RIPE
remarks: complaints about spam and other net-abuse: [e-mail]
notify: [e-mail]
notify: [e-mail]
notify: [e-mail]
mnt-by: UPCNL-MNT
changed: [e-mail] 20010205
changed: [e-mail] 20010420
changed: [e-mail] 20010516
changed: [e-mail] 20020220
changed: [e-mail] 20020627
source: RIPE

role: EuroNet Internet Administrative Role Account
address: Wanadoo Nederland BV (formerly EuroNet Internet BV)
address: COD / IKC / Network
address: Muiderstraat 1
address: 1011 PZ Amsterdam
address: The Netherlands
phone: [phone]
fax-no: [phone]
e-mail: [e-mail]
admin-c: AW2096-RIPE
tech-c: BL78
tech-c: PC2773-RIPE
tech-c: FB1141-RIPE
tech-c: EI89-RIPE
nic-hdl: EIAR1-RIPE
remarks: In case of abuse issues:
remarks: - For WANADOO blocks please contact [e-mail]
remarks: - For all other blocks please contact [e-mail]
mnt-by: EURONET-MNT
changed: [e-mail] 20000731
changed: [e-mail] 20011101
changed: [e-mail] 20030109
changed: [e-mail] 20030902
source: RIPE

role: EuroNet Internet Technical Role Account
address: EuroNet Internet BV
address: Internet Knowledge Center
address: Muiderstraat 1
address: 1011 PZ Amsterdam
address: The Netherlands
phone: [phone]
fax-no: [phone]
e-mail: [e-mail]
admin-c: AW2096-RIPE
admin-c: FB1141-RIPE
tech-c: BL78
tech-c: FB1141-RIPE
tech-c: JH2081-RIPE
nic-hdl: EITR1-RIPE
notify: [e-mail]
mnt-by: EURONET-MNT
changed: [e-mail] 20000731
changed: [e-mail] 20010928
changed: [e-mail] 20030213
source: RIPE

-------------------

IP: 62.194.47.175(request time out)

% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html

inetnum: 62.194.0.0 - 62.195.255.255
netname: NL-A2000-20001010
descr: UPC Netherlands
descr: Provider Local Registry
country: NL
admin-c: RIHU1-RIPE
tech-c: RIHU1-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: A2000-KTA-MNT
mnt-routes: A2000-KTA-MNT
changed: [e-mail] 20001010
changed: [e-mail] 20010115
changed: [e-mail] 20011217
changed: [e-mail] 20020419
changed: [e-mail] 20020423
changed: [e-mail] 20020603
changed: [e-mail] 20020709
source: RIPE

route: 62.194.0.0/15
descr: A2000 / Kabeltelevisie Amsterdam B.V.
origin: AS8209
remarks: ---------------------------------------------------
remarks: E-mail is the preferred contact method!
remarks: ---------------------------------------------------
remarks: Please use one of the following addresses:
remarks: [e-mail] - for abuse notification
remarks: [e-mail] - Technical support for customers
remarks: [e-mail] - For the hostmaster team
remarks: ---------------------------------------------------
notify: [e-mail]
mnt-by: A2000-KTA-MNT
changed: [e-mail] 20010105
source: RIPE

person: Richard Huisman
address: UPCnl
address: Kabelweg 51
address: 1014 BA Amsterdam
address: The Netherlands
phone: [phone]
fax-no: [phone]
e-mail: [e-mail]
nic-hdl: RIHU1-RIPE
notify: [e-mail]
remarks: E-mail is the preferred contact method!
remarks: ---------------------------------------
remarks: -- For abuse notification please use --
remarks: -- --
remarks: -- [e-mail] --
remarks: -- --
remarks: ---------------------------------------
changed: [e-mail] 20000417
changed: [e-mail] 20021003
changed: [e-mail] 20030807
source: RIPE


-------------------


Wat moet ik hiermee doen ??? IS het ernstig voor mij? Mijn vuurmuur houd hem tegen, maar wat is dit en waarom? Zo belangrijk ben ik ook niet hoor

[Glashelder]

Ik denk dat dit typisch zo'n geval is van verkeerde benaming. Net zoals een portscan soms door Zonealarm bestempelt wordt als een gevaarlijke aanval ofzo

Als dit echt een Denial Of Service attack was dan had je dit nu niet kunnen posten denk ik

[paella]

Code Red is een relatief oud virus/worm. Kan je niets aan doen, hij is tegengehouden, en dus kan het verder geen kwaad. Is allemaal automatisch als je besmet bent, dus de veroorzaker moet zijn machine ontwormen

[ Voor 6% gewijzigd door paella op 11-09-2003 16:58 ]

[Xandrios]

Dit is geen echte DDos: dan zou ie wel heel wat vaker toeslaan. Mischien inderdaad code red, zoals hierboven al wordt aangegeven.

Valt weinig aan te doen helaas. Je kunt even de manual van je vuurmuur doorlezen, mischien staat daar nog in wat voor alternatieve attack het kan zijn.

iig, is het niet de bedoeling dat je al die persoonsgegevens etc gaat posten, vandaar dat ik deze thread sluit. Zolang ze niet met 100en tegelijk komen, en je firewall blockt het, is het totaal safe