[Dshield] Kornet.Net

Malcolm Joosse malcolm at hotlinesupport.com
Wed Mar 6 05:32:53 GMT 2002


Grant,
Do you realise that you have blocked Australia, New Zealand and most of the south pacific with your APNIC block ?
I am feeling isolated from your services :-)
Regards
Malcolm Joosse 
Hotline Support (Total IT Solutions)
Australia 
Ph: +61 2 8904 9777 
Fax: +61 2 8904 9666 
Email: malcolm at hotlinesupport.com 
Web: www.hotlinesupport.com 

|    |            _          ____  
|    |           |_|        |      
|____|                      |____      Total IT Solutions    
|    | ___ ___          ___      |      __  __  ___  __ ___
|    ||   | | |   ||\ ||__       ||   ||__||__||   ||__| |  PTY LTD
|    ||___| | |___|| \||___ _____||___||   |   |___||\   |  .com.au

***************************************************************************
This communication contains information which is confidential and 
may also be privileged.  It is for the exclusive use of the 
intended recipient(s).  If you are not the intended recipient(s), 
please note that any distribution, copying or use of this 
communication or the information in it is strictly prohibited.  
If you have received this communication in error, please notify 
the sender immediately and then destroy any copies of it.
***************************************************************************


-----Original Message-----
From: list-admin at dshield.org [mailto:list-admin at dshield.org]On Behalf Of
Grant Thurman
Sent: Wednesday, March 06, 2002 12:07 PM
To: list at dshield.org
Subject: [Dshield] Kornet.Net


Brian Burrington,

I have blocked the following with good success, and don't feel we have lost
much in the process, I will always be redefining my list but the firewall
alerts have dropped way off by fine tuning my port blocking and blocking the
following:

210.52.76.0 -> 210.52.77.255 China (Bulk of the hacking seems to come from
this IP block)

211.51.0.0  -> 211.51.255.255 Korea (Bulk of the hacking seems to come from
this IP block)

193.204.0.0 -> 193.204.0.255 Italy (Yep, they kept banging away at me)

202.0.0.0   -> 203.255.255.255  Apnic  (Bulk of the hacking seems to come
from this IP block)

I get some 64.????? hacking but the IP blocks are all over the board, mine
even starts with 64. as well as our servers at the California, Cox.Net
commercial data center and I can't seem to get a handle on the range the
hackers are coming in on.

Good luck...

===============================
Grant Thurman
Netprecision, Inc.
714.832.8932 Cell: 714.813.3690
===============================

_______________________________________________
Dshield mailing list
Dshield at dshield.org
To change your subscription options (or unsubscribe), see: http://www1.dshield.org/mailman/listinfo/list




More information about the list mailing list