<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
Michael, i think you right, but what should i do?<BR>I need my data server online at all times!<BR>My isp (rogers) cant block the ip address,<BR>
they say they need it!<BR>
I also cant stop the data flow, the NSD has no controls its just a piece of hardware!<BR>
Help?<BR> <BR>> From: mlauzon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org<BR>> Date: Tue, 23 Jun 2009 17:55:16 -0400<BR>> Subject: Re: [TLUG]: Port 80?<BR>> To: tlug-lxSQFCZeNF4@public.gmane.org<BR>> <BR>> On Tue, Jun 23, 2009 at 17:41, cameron lord<trieocorp-PkbjNfxxIARBDgjK7y7TUQ@public.gmane.org> wrote:<BR>> > I already did, it still says apache, i hoked up my winxp laptop (sucks) to<BR>> > my swiches listen port, i have an intrusion problem o.O i found that when i<BR>> > run Wireshark i see TONNNS of data comming from my networked storage unit<BR>> > to, 99.243.63.182(AXCellsecure.trieocorp.e6a2ffi6ad.xxx.xxx.xxx.xxx) which<BR>> > is fine, its my isp assinged ip adderss, but when i look at the same addr<BR>> > on the computer it was given to , i have no traffic, and the data only flows<BR>> > when the the computer at my location is off. Also when i listen on my<BR>> > Firebox watchgaurd i see no traffic except for pings and dchp ack, and my<BR>> > vnc server, someone is bypassing one of the most advanced hardware firewalls<BR>> > ever! The data i found comming out of my cable modem is all going to<BR>> > 125.16.27.50,and then is being served to xxx.xxx.xxx.xxx, whichisnt very<BR>> > helpfull at all. so far theyve downloaded 2.5 TB of my data and i cant stop<BR>> > them, i need to have my server online at all times!<BR>> ><BR>> ><BR>> > cameron lord; Axcellsecure<BR>> ><BR>> <BR>> It appears that you're being hacked by someone in Hyderabad, India:<BR>> <BR>> Hostname: 125.16.27.50<BR>> ISP: Bharti Broadband<BR>> Organization: PROKARMA SOFTECH PVT LTD<BR>> Proxy: None detected<BR>> Type: Cable/DSL<BR>> <BR>> Of course, they may be using that ISP's servers to route to your<BR>> server, so they could be anywhere.<BR>> <BR>> -- <BR>> Sincerely,<BR>> <BR>> Michael Lauzon<BR>> --<BR>> The Toronto Linux Users Group. Meetings: http://gtalug.org/<BR>> TLUG requests: Linux topics, No HTML, wrap text below 80 columns<BR>> How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists<BR><br /><hr />Create a cool, new character for your Windows Live™ Messenger. <a href='http://go.microsoft.com/?linkid=9656621' target='_new'>Check it out</a></body>
</html>