Someone cleaned up my IB account (almost)

Name: 1Cust250.tnt1.augusta.ga.da.uu.net
Address: 67.232.136.250

Lookup 67.232.136.250 (1cust250.tnt1.augusta.ga.da.uu.net) in EXTENDED Zones (38)
Network: ARIN/UUNET01DU 67.192.0.0-67.255.255.255 @uu.net
Country: US, Location: Fairfax, Virginia (6131km)
Results: Positive=3, Negative=35 (2002-05-08 12:43:47 GMT)

IP-Whois 67.232.136.250: (ARIN/UUNET01DU)[Querying whois.arin.net]
[whois.arin.net]
UUNET Technologies, Inc. (NETBLK-UUNET01DU)
3060 Williams Drive, Suite 601
Fairfax, VA 22031
US

Netname: UUNET01DU
Netblock: 67.192.0.0 - 67.255.255.255
Maintainer: UUDA

Coordinator:
UUNET, Technical Support (OA12-ARIN) help@uu.net
() -

Domain System inverse mapping provided by:

DIALDNS1.UU.NET 153.39.194.10
DIALDNS2.UU.NET 153.39.194.26

ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE

Record last updated on 25-Mar-2002.
Database last updated on 7-May-2002 20:01:18 EDT.


-----------
Obviously this is the ISP he is using, probably not "he" himself who's probing your PC. It is however a place to start from.
The ISP will know "who" it really is as it must be a customer of theirs.
Good luck.

Hope this helps. :)
 
Originally posted by easyrider
This morning right after I logged into IB I got a notice from ZoneAlarm that someone was trying to access my computer from 67.232.136.250. Does anybody know a way to track this down to the sender?
More...

You will notice that these attacks happen all the time. Do yourself a favor and get a firewall. Here's the tracert. I removed my IP address.

Mike

3 40 ms 40 ms 50 ms user2.net063.nj.sprint-hsd.net [207.14.188.2]
4 50 ms 40 ms 50 ms sl-gw16-pen-10-0.sprintlink.net [144.228.181.41]

5 40 ms 50 ms 50 ms sl-bb26-pen-0-0.sprintlink.net [144.232.5.97]
6 50 ms 50 ms 40 ms sl-bb22-pen-9-0.sprintlink.net [144.232.16.57]
7 50 ms 40 ms 50 ms sl-bb22-nyc-13-0.sprintlink.net [144.232.9.69]
8 50 ms 50 ms 40 ms POS1-1.BR3.NYC8.ALTER.NET [204.255.169.133]
9 50 ms 50 ms 50 ms 0.so-5-2-0.XL1.NYC8.ALTER.NET [152.63.19.54]
10 50 ms 50 ms 40 ms 0.so-2-0-0.TL1.NYC8.ALTER.NET [152.63.0.153]
11 80 ms 90 ms 80 ms 0.so-0-0-0.TL1.ATL1.ALTER.NET [152.63.101.57]
12 60 ms 70 ms 70 ms 0.so-7-0-0.XL3.ATL1.ALTER.NET [152.63.86.86]
13 70 ms 71 ms 70 ms 195.ATM12-0-0.HR2.ATL1.ALTER.NET [146.188.232.17
]
14 70 ms 60 ms 70 ms 102.ATM1-0-0.DR1.ATL1.ALTER.NET [152.63.80.21]
15 110 ms 110 ms 110 ms tnt1.augusta.ga.da.uu.net [67.232.128.4]
16 260 ms 210 ms 241 ms 1Cust250.tnt1.augusta.ga.da.uu.net [67.232.136.2
50]

Trace complete.
 
Originally posted by easyrider
This morning right after I logged into IB I got a notice from ZoneAlarm that someone was trying to access my computer from 67.232.136.250. Does anybody know a way to track this down to the sender?
More...

Yes; if you get the full version of zonealarm it will do just that.
 
Several weeks ago some dirty son of a b**** posted a link to an electronic trading book on this site. The book had been hacked into and two viruses placed in it. From what I can remember one of these viruses was a key logger which had originally been written in Russia. Baron did a trace on the poster but I think it was lost somewhere in the Middle East.

Your reference to possible terrorism got me thinking, did you down load this e trading book or have you received any emails from someone who downloaded it?
 
Did you find any trojan on your PC ?

Once someone gets running a trojan on other people´s PC he almost can do anything he wants.
No problem to read passwords from keyboard or to forward emails (i.e. your tokens from IB) found in your ´inbox´.
 
Originally posted by easyrider
This morning right after I logged into IB I got a notice from ZoneAlarm that someone was trying to access my computer from 67.232.136.250. Does anybody know a way to track this down to the sender?
More...

No need to use ZoneAlarm Pro. There are many websites that do traceroutes. A site that is jampacked with useful utilities for hunting down hackers and spammers is www.samspade.org
It is being overhauled right now but check back in a few days.
 
I instdalled Zone Alarm yesterday, the pro version. I have already received several notices that someone was trying to get in. I would think it was just cookies or something but I was not even using the browser last time it happened. Scary stuff.
 
Hard to believe these days that many were or are wide open to hackers. Security is even more important than trading.

mktman
 
Your ISP has a range of IP numbers and you get one them.
Anybody with too much time can do a scan thru that range.
Scan means they send out a bunch of ´pings´ and wait for reply.

ZA writes any such request into a log file, but does not reply ("stealth mode").
 
"I instdalled Zone Alarm yesterday, the pro version. I have already received several notices that someone was trying to get in. I would think it was just cookies or something but I was not even using the browser last time it happened. Scary stuff."

Everyone who first gets a firewall says the same thing.
Its quite enlightening to when you realize all the times you were being probed without you knowing it.
:eek:
 
You must log in or register to reply here.
Back
Top