Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

ISA automatically contact whois email of an attacker?

Posted on 2004-10-08
3
Medium Priority
?
304 Views
Last Modified: 2010-04-09
Alright,
I frequently am getting alerts from ISA server informing me of a "port scan" or other attack. Does anyone know of a way that I can get ISA to automatically take the offending IP, whois it, get the contact email, and email them telling them the IP of the attacker?

Let me know of any ideas. Thanks,
Matt
0
Comment
Question by:hattmardy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 23

Accepted Solution

by:
Tim Holman earned 880 total points
ID: 12261125
If you can get the log-file into a text readable format, you could knock up a batch script to do this for you.
However...  if I were you, I would ignore these port-scans and put them down to white noise.
Everytime you report someone, there'll be another 10 on your doorstep.
Also, automated emails are spam, so make sure you don't get into trouble !
0
 
LVL 14

Assisted Solution

by:chris_calabrese
chris_calabrese earned 880 total points
ID: 12261132
This is usually not considered worthwhile since a) its very hard to get an ISP to act just based on port scanning, b) most of this type of traffic is generated from worms and such, so there's no hope of keeping up with the deluge of differnt addresses, following up on each one, etc., and c) "real" attackers (the kind you need to worry about) are likely to notice that you did the whois lookup and sent the email so they'll know that you're watching.
0
 
LVL 2

Author Comment

by:hattmardy
ID: 12263899
Thanks guys, you both made good points. I split the points. Keep up the good work.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

To setup a SonicWALL for policy based routing to be used with the Websense Content Gateway there are several steps that need to be completed. Below is a rough guide for accomplishing this. One thing of note is this guide is intended to assist in the…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…
Suggested Courses

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question