port scanning

I am in need of some help. I have xp,I sign onto to aol
via dialup, my antivirus is up to date, i am running a
firewall.
i am constantly seeing ip scans coming from same
addresses tring to access the same ports every time i
sign online. Sometimes i can be online with no scan for a
while, other times, they just don't stop.
210.5.22.22,
218.15.192.64,
220.112.155.77,
I have tried tracing these scans and blocking and
reporting the ip groups <to no avail>
any ideas anyone to get to the bottom of this?

Lanwench
Wed Aug 06 08:57:24 CDT 2003

Depends how dedicated you want to be. Since your firewall is blocking them,
it isn't really an emergency, is it? The computers in question may be
running trojans the owners know nothing about. Personally, I think life is
too short to worry about tracking this sort of thing on a home PC....

Raquel wrote:
> I am in need of some help. I have xp,I sign onto to aol
> via dialup, my antivirus is up to date, i am running a
> firewall.
> i am constantly seeing ip scans coming from same
> addresses tring to access the same ports every time i
> sign online. Sometimes i can be online with no scan for a
> while, other times, they just don't stop.
> 210.5.22.22,
> 218.15.192.64,
> 220.112.155.77,
> I have tried tracing these scans and blocking and
> reporting the ip groups <to no avail>
> any ideas anyone to get to the bottom of this?

Karl
Wed Aug 06 08:58:08 CDT 2003

Port scans happen so often, there's little you can or need to do, besides
block them using a firewall. [It's possible that these might not really be
port scans too... it seems unproductive for someone to keep scanning you
over and over.] You can look up those IP addresses at www.network-tools.com
and http://visualroute.visualware.com to try to tell what they are and
whether they are malicious. I also highly recommend the free
www.mynetwatchman.com and www.dshield.org software which automatically
reports hackers to the hackers' ISP. Keep in mind that IP addresses you see
might belong to an innocent person whose computer has been compromised.
More info:

http://securityadmin.info/faq.htm#trace
http://securityadmin.info/faq.htm#harden

http://securityadmin.info/faq.htm#hacked
http://securityadmin.info/faq.htm#re-secure



"Raquel" <BL0NDIED0LL@aol.com> wrote in message
news:0de501c35c20$fe8ba7a0$a101280a@phx.gbl...
> I am in need of some help. I have xp,I sign onto to aol
> via dialup, my antivirus is up to date, i am running a
> firewall.
> i am constantly seeing ip scans coming from same
> addresses tring to access the same ports every time i
> sign online. Sometimes i can be online with no scan for a
> while, other times, they just don't stop.
> 210.5.22.22,
> 218.15.192.64,
> 220.112.155.77,
> I have tried tracing these scans and blocking and
> reporting the ip groups <to no avail>
> any ideas anyone to get to the bottom of this?
>

Peter
Wed Aug 06 09:59:14 CDT 2003

If you get the IP address and go to the
website "arin.net", you can put in the IP address and do a
whois search. It will give you the ISP that owns that
block of IP address' and there is an technical or
administrative e-mail address you can send this to.
Usually you will need to send them a "log" for proof of it
and they will usually warn or disable that users ISP
access.