port scan
 

A friend of mine keeps getting warnings from Panda that the following IP is attempting to access his computer.

This has been going on for about three weeks now. Luckily the software blocks it.

Here is the IP: 204.16.208.135

Any ideas?

OrgName: FAST COLOCATION SERVICES
OrgID: FCS-73
Address: 3791 N. Edgewater Dr
City: Wasilla
StateProv: AK
PostalCode: 99654
Country: US

NetRange: 204.16.208.0 - 204.16.211.255
CIDR: 204.16.208.0/22
NetName: FC-BLK-1
NetHandle: NET-204-16-208-0-1
Parent: NET-204-0-0-0-0
NetType: Direct Allocation
NameServer: SANDY.THEHIDEOUT.NET
NameServer: SANDY2.THEHIDEOUT.NET
Comment: For Abuse Notices please visit http://www.fastcolocation.net/abuse/
RegDate: 2005-11-07
Updated: 2006-07-31

RAbuseHandle: NAD41-ARIN
RAbuseName: NOC Abuse Department
RAbusePhone: +1-703-637-6336
RAbuseEmail: *********@fastcolocation.net

Panada AV sucks. I reccomend he removes that software and gets something else. That is IF he can remove it. I wouldn't trust anything their crap told me.

I wouldn't worry about it

Do a true port scan to see if any of the ports are actually opened. Use Steve Gibson's to do this:

GRC port scan

Wanna know if your firewall leaks? Do the leak test

He has some really neat stuff on his site and I used to use it quite a bit. Still visit it every so often.

Missie

:thumbsup

well if they have been doing a port scan for the last 3 weeks , i wouldn't worry about it , port scan is just knocking on the doors does nothing

But if the firewall keeps "replying" they'll keep coming back hoping that one day they'll be able to get in. A firewall that sends back any kind of answer, even if it's to say that it didn't allow the connection, is telling the other side that there is someone living at that address. What you need is a real secure firewall that will block the connection attempt and will NOT send anything back.

Do the port scan and the leak test, even if they're somewhat old, it still works.

Missie

Great info, thanks.

get an old pc from someone, an old 200mhz will do, put 2 nics in it and load smoothwall http://smoothwall.org/ on it. absolute best thing you can do. no other product out there will secure you as well as that will.

heres a link to portscan yourself and others..

http://gfy.webspacemania.com/port/

webspacemania.com may cause a breach of browser security.



We blocked your browser from visiting this site.


In our tests, webspacemania.com attempted to make unauthorized changes to our test PC by exploiting a browser security vulnerability. This is a serious security threat which could lead to an infection of your PC.

Missie

mcafee is stupid sometimes ( im assuming thats where your message comes from )

try www.ravenriley.com

Yes, but it doesn't block ravenriley, it totally blocked the other one though??

Missie

thats wierd because look at the full advisory for both sites


Raven riley
http://www.siteadvisor.com/sites/ravenriley.com

webspacemania
http://www.siteadvisor.com/sites/webspacemania.com

clean site
http://www.siteadvisor.com/sites/geocities.com

whats stupid is webspacemania.com is a host just like geocities.com , i m sure at one point or another they have both had virus's on them yet mcafee flags webspacemania.com

if mcafee had flagged geocities like that long ago it wouldnt be so big..

Nice one, pro. :thumbsup

nothing serious, dont sweat it...