Re: Reporting organized penetration attempt from multiple sites

Article View: comp.security.misc

Article #1136

Back to comp.security.misc Previous Next

#1136

From: Bob Tinsley
Date: Thu, 12 Nov 1998 00:00

17 lines
1471 bytes

Corwin J. Grey wrote:
>Where/who would be the best place to report an attempt to penetrate a
> single target with the attacks originating from multiple nonresolving
> ip addresses (over 120 IP addresses involved)?

Your own internal audit department -- it's time to dust off those
security policies and ensure that they're being complied with.

Second: CERT? Your own ISP to help trace it back? The
police/FBI/whatever
if your site is of a high enough value to get them interested? Just
don't
get your hopes up with this option.

Cheers,

	-- Bob

Technical Details

Message-ID: <364A3101.ADBC459F@earthrise.demon.co.uk>

Path: arc1-ca.pugleaf.net!unknown!not-for-mail

References: <364a1860.7158945@news2.newscene.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10952f,2aa59064f4af15b6
X-Google-Attributes: gid10952f,public
X-Google-Thread: 1133d0,2aa59064f4af15b6
X-Google-Attributes: gid1133d0,public
X-Google-Thread: ff723,2aa59064f4af15b6
X-Google-Attributes: gidff723,public
From: Bob Tinsley <bob@earthrise.demon.co.uk>
Subject: Re: Reporting organized penetration attempt from multiple sites
Date: 1998/11/12
Message-ID: <364A3101.ADBC459F@earthrise.demon.co.uk>
X-Deja-AN: 410897942
Content-Transfer-Encoding: 7bit
X-NNTP-Posting-Host: earthrise.demon.co.uk:193.237.87.138
References: <364a1860.7158945@news2.newscene.com>
Content-Type: text/plain; charset=us-ascii
X-Complaints-To: abuse@demon.net
X-Trace: news.demon.co.uk 910828064 nnrp-04:13228 NO-IDENT earthrise.demon.co.uk:193.237.87.138
MIME-Version: 1.0
Newsgroups: comp.security.misc,cern.security.unix,comp.security.unix

Reply to Parent Message