?
Solved

terminal server attack from specific IP addresses

Posted on 2013-01-23
1
Medium Priority
?
637 Views
Last Modified: 2013-01-25
We have a Sonicwall for firewall and win 2k3 and win 2k8 terminal servers.

Someone is trying to access our terminal servers  using the "admin" user name along with other user names.  So far access has been denied but I know the specific IP addresses that are trying to attack us....Is there anything I can do to block these particular IP Addresses?

Also, the ports that are being used to try to gain access are different every time.
Any and all advice/help would be greatly appreciated!
0
Comment
Question by:Lamrski
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 40

Accepted Solution

by:
als315 earned 2000 total points
ID: 38810939
You can add blocking rule for this IP address. Sample you can find here:
https://www.fuzeqna.com/sonicwallkb/consumer/kbdetail.asp?kbid=5973

You can also determine ISP, where this address is:
http://whois.domaintools.com/
and write a letter to ISP's contact address, descrbing situation.
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There is a lot to be said for protecting yourself and your accounts with 2 factor authentication.  I found to my own chagrin, that there is a big downside as well.
The Cyber News Rundown brings you the latest happenings in cyber news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst, and a guy with a passion for all things security. Any more questions? Just ask.
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question