In the last week my firewall has logged 147 port scan attacks, all minor in severity. What should be doing about this?
The culprits IP addresses are:
206.47.244.27 (10 port scan attacks, 5 ports scanned each time)
206.47.244.29 (88 port scan attacks, 5 ports scanned each time)
207.33.111.35 (47 port scan attacks, 5 ports scanned each time)
65.37.42.105 (2 port scan attacks, 5 ports scanned each time)
Backtracing names the following:
#1
--------
Bell Canada WORLDLINX03 (NET-206-47-0-0-1)
206.47.0.0 - 206.47.255.255
Bell SRF0121-CA (NET-206-47-244-0-1)
206.47.244.0 - 206.47.244.255
#2
--------
Electric Lightwave Inc ELI-3-NETBLK99 (NET-65-37-0-0-1)
65.37.0.0 - 65.37.127.255
ADSL Rochester NY ELI-1418-6537320 (NET-65-37-32-0-1)
65.37.32.0 - 65.37.63.255
#3
--------
OrgName: Verio, Inc.
OrgID: VRIO
Address: 8005 South Chester Street
Address: Suite 200
City: Englewood
StateProv: CO
PostalCode: 80112
Country: US
ReferralServer: rwhois://rwhois.verio.net:4321/
NetRange: 207.33.0.0 - 207.33.255.255
CIDR: 207.33.0.0/16
NetName: VRIO-207-033
NetHandle: NET-207-33-0-0-1
Parent: NET-207-0-0-0-0
NetType: Direct Allocation
NameServer: NS0.VERIO.NET
NameServer: NS1.VERIO.NET
NameServer: NS2.VERIO.NET
NameServer: NS3.VERIO.NET
NameServer: NS4.VERIO.NET
Comment: ********************************************
Comment: Reassignment information for this block is
Comment: available at rwhois.verio.net port 4321
Comment: ********************************************
RegDate: 2001-02-05
Updated: 2003-08-27
TechHandle: VIA4-ORG-ARIN
TechName: Verio, Inc.
TechPhone: +1-303-645-1900
TechEmail: vipar@verio.net
OrgAbuseHandle: VAC5-ARIN
OrgAbuseName: Verio Abuse Contact
OrgAbusePhone: +1-800-551-1630
OrgAbuseEmail: abuse@verio.net
OrgNOCHandle: VSC-ARIN
OrgNOCName: Verio Support Contact
OrgNOCPhone: +1-800-551-1630
OrgNOCEmail: support@verio.net
OrgTechHandle: VIA4-ORG-ARIN
OrgTechName: Verio, Inc.
OrgTechPhone: +1-303-645-1900
OrgTechEmail: vipar@verio.net
Port Scan Attacks Logged
