Blocked a dodgy I.P. HELP!

[XP Abuser]

Details: Unused port blocking has blocked communications
Inbound TCP connection
Remote address,local service is (4.64.218.228,4662)

Click on the address to trace the attacker
You can get detailed information about this attack at Symantec Security Response

i got this in log viewer in NIS, notice I.P. starts with 4 its on an earthlink network, this is not a normal ip is it?

need advice


BTW it was traced to Washington. can't be anything to do with my avatar. can it?

 

[Enyo]

Looks normal to me, earthlink are the connection provder and the company is:

Genuity
225 Presidential Way
Woburn, MA, 01888
US

csoulia@genuity.com
+1-800-436-8489

http://ws.arin.net/cgi-bin/whois.pl?queryinput=! NET-4-0-0-0-1

The port is eDonkey default TCP port and is a common one to appear in logs, especially if you happen to be running P2P software.

Is it a one time event?

 

[XP Abuser]

yeh i guessed it was emule

right so its some d00d using his company pc for P2P

why does it start with 4. never seen this b4 and remember someone saying that I.P.s that start with 4 are used by anti piracy *****es

may be wrong. ah well ****it i blocked their ass anyhows

no it reoccures every minute:happy:

 

[Enyo]

There is not way to say that a IP starting with a 4 (Genuity seem to own that whole block) is used by anti piracy units its not possible to pin point them, they could be located at any address.

I assume you refer to the fake P2P hosts and internet crawling bots that are around searching for illegal sites and putting fake files onto P2P when you say anti piracy *******. Its becoming more common now. Im sure however you have NOTHING to fear from these folk!!!

IPs can be right down low.

The 1.0.0.0 - 1.255.255.255 is reserved by IANA, the 2.0.0.0 - 2.255.255.255 also reserved by IANA and the first IP block out there is:

http://ws.arin.net/cgi-bin/whois.pl?queryinput=3.0.0.0

General Electric Company

 

[XP Abuser]

ok cheerz