I have the IP info, now what???

[SteveS235]

Ok, I just had someone try to hack into my system. My Firewall log says it was a Smurf attack (Whatever the hell that is, anyone know???).

I have the IP address, which I used to run a reverse lookup. It came up with the name of the site and the technical contact info (in South America!).

My question is, what to do/what can I do next?


I don't bother with pings, traceroutes or NETBIOS Browsing stuff, but according to my antivirus, this was a hacker.

[fevertje]

Report the guy to your isp. Provide them with the info you find in your firewall logs concerning this hack-attack.

Normally they should take action and look into it further.

[creative666]

http://www.dshield.org

This site is a must if you think that you have been hacked or someone has tried to hack you, it'll clear up any questions that you have.

A smurf attack is when a large number of ICMP packets are forged and sent to an unknowing host, the host replys to the wrong address and cause the host to slow down and even crash. It is a type of denail of service attack... very nasty if done properly.

[wildlife]

Through the reverse look up you found the ISP that was being used to "hack into" your pc. What I have done in the past is to e-mail the OFFENDING ISP. Usually the ISP has a web site and you can find an administrator or contact e-mail there.

I've had some success in dealing with US ISP's on hack attempts, but you may be just flat out ignored by ISP's in other countries...

Good luck!
*plink, plink*
Wildlife