Need help with a script kiddie

[mimi]

[quote author=Rastar link=board=5;threadid=3738;start=0#37848 date=1023928360]
Okay so Mcaffee returned this report

Blocked port scan attack the ip associated with this attack was 63.251.119.14 port 20480 with the local port of 17924.

Mind you this is a windows machine which SHOULD not have any ports open at my linksys router but... Obviously he got as far as the firewall.

A traceroute returns unknown host
so does a whois

How do I find out who this is? Which program should I run to figure it out.

Ras
[/quote]
I ran traceroute and got this:

TraceRoute -
Generated by CyberKit Version 2.5
Copyright © 1996-2000 by Luc Neijens

Address: 63.251.119.14 - 63.251.119.14
Number of Packets: 1
Packet size: 64
Trace Hop 1 through 30
Timeout: 5
Resolve Addresses: Yes
Don't Fragment: No

#1 Unavailable (212.202.223.252): TTL Exceeded, ttl=64, 5 ms
#2 core1.fra.qsc.de (212.202.222.29): TTL Exceeded, ttl=253, 4 ms
#3 Unavailable (212.162.44.113): TTL Exceeded, ttl=253, 7 ms
#4 unknown.Level3.net (195.122.136.34): TTL Exceeded, ttl=251, 6 ms
#5 so-3-0-0.mp2.London1.Level3.net (212.187.128.57): TTL Exceeded, ttl=250, 19 ms
#6 so-1-0-0.mp2.NewYork1.Level3.net (212.187.128.153): TTL Exceeded, ttl=249, 84 ms
#7 so-3-0-0.mp1.LosAngeles1.Level3.net (64.159.1.125): TTL Exceeded, ttl=248, 154 ms
#8 pos8-0.core2.LosAngeles1.Level3.net (209.247.10.198): TTL Exceeded, ttl=248, 154 ms
#9 Unavailable (204.255.169.109): TTL Exceeded, ttl=247, 163 ms
#10 0.so-0-1-0.XL1.LAX9.ALTER.NET (152.63.113.10): TTL Exceeded, ttl=245, 159 ms
#11 0.so-3-0-0.XR1.LAX9.ALTER.NET (152.63.115.157): TTL Exceeded, ttl=244, 160 ms
#12 191.at-0-1-0.CL1.SDG2.ALTER.NET (152.63.112.21): TTL Exceeded, ttl=243, 160 ms
#13 195.ATM7-0.GW2.SDG1.ALTER.NET (146.188.249.81): TTL Exceeded, ttl=243, 164 ms
#14 internap2-sdg.customer.alter.net (157.130.233.134): TTL Exceeded, ttl=245, 176 ms
#15 border2.fe0-0-bbnet1.sdg.pnap.net (63.251.127.5): TTL Exceeded, ttl=245, 176 ms
#16 Unavailable (63.251.119.14): Echo Reply, ttl=244, 172 ms

Statistics: Out 16, in 16, loss 0%, times (min/avg/max) 4/110/176 ms

And a who is search got this:

InterNAP Network Services (NETBLK-NETBLK-PNAP-11-99) NETBLK-PNAP-11-99
****************** 63.251.0.0 - 63.251.255.255
Akamai Technologies (NETBLK-PNAP-SDG-AKAMAI-RM-01) PNAP-SDG-AKAMAI-RM-01
****************** 63.251.119.0 - 63.251.119.63

[Schotty]

[quote author=Rastar link=board=5;threadid=3738;start=0#37848 date=1023928360]
Okay so Mcaffee returned this report

Blocked port scan attack the ip associated with this attack was 63.251.119.14 port 20480 with the local port of 17924.

Mind you this is a windows machine which SHOULD not have any ports open at my linksys router but... Obviously he got as far as the firewall.

A traceroute returns unknown host
so does a whois

How do I find out who this is? Which program should I run to figure it out.

Ras
[/quote]

Well, Rastar, if the kid is on dialup -- hes got a DHCP address. So the IP is probably part of a block. I would block the whole subnet he is on.

[stryder144]

[quote author=BurntAsh link=board=5;threadid=3738;start=0#37758 date=1023856760]
find out the lil shits ip address and pXr.c em also submit his email address to a bunch of gay porn things.
[/quote]

I would use his im name at a gay forum/chat site. That way, every time he logs onto msn, he will have strangers seeking to pester him but good.

[xin]

Hi
in M$ get onto the messenger, and send the little p#%&k a file, send him whatever you want, the bigger the better, then run "netstat -n" in command prompt, there is a list of all of your connections, sift thru them and in the end youll find the little punkass's IP, he's a skript kiddie so he's probably on dialup, so report him.
Also, look around www.neworder.box.sk pleanty of things there, hell on occasions you can find texts on how to hack stuff e.g. netbios.

hope this helped
no im not a skriptkiddie

[Feztaa]

[quote author=Rastar link=board=5;threadid=3738;start=0#37848 date=1023928360]Okay so Mcaffee returned this report

Blocked port scan attack the ip associated with this attack was 63.251.119.14 port 20480 with the local port of 17924.[/quote]

How do you even know if that's the same guy? Random port scans fly across the internet all the time. It could just be flotsam and jetsam of the internet.

Try installing ZoneAlarm, probably the best firewall available for windows. It'll block those portscans, and most other things.

[xin]

hi
F*** Zone Alarm, get Tiny Personal Firewall, its simple, password protected, easy yo manage, the list goes on