Tech Revenge

jester77

For the past few weeks someone has been sending requests and port scans through 125.45.109.166 trying to access my home network and they have made multiple attempts to try and log into my servers via FTP and SSH. I renew my IP address but that only lasts a few hours before they are at it again.

I see that I am not the only one being pestered. Anyone got any ideas on how to turn the screws here?

starbelgrade

Download Peerblock.

syklops

If you renew your IP address, how are they finding you again?

Have you DynamicDNS set up or something?

jester77

Yeah, I've just a basic Netgear router that has very little settings to protect or block these attacks and I use DynDNS to connect to my network from outside

MunsterCycling

Then make a change to your DynDNS account name and you should shake them off, they are clearly using your DynDNS address to continue the attempts after you renew.

witnessmenow

MunsterCycling wrote: »

Then make a change to your DynDNS account name and you should shake them off, they are clearly using your DynDNS address to continue the attempts after you renew.

Or maybe there is a some software "phoning home"

CreepingDeath

I looked up the IP address on http://cqcounter.com/whois

It's a Chinese IP address.
There are a number of e-mails listed for that IP range where you can report abuse.

abuse@chinaunicom.cn
abuse@public.zz.ha.cn
abuse@cnc-noc.net

spider guardian

not much you can do about it man, if someone wants to try and access your public-facing setup then they can try all they want. your best bet is to make sure your firewall is properly configured, know exactly what programs you have listening for connections and make sure you use strong passwords. Follow all that and you'll be sound

jpl888

You could change the SSH port your server is using to a non-standard one. Not sure what you would do about ftp though. Perhaps load fail2ban assuming you are using some form of Linux.