Continuously Under Attack

[robert.mcclain]

I am trying to block this person(s) from hitting my network. Problem is the IP changes from day to day. I see alarms on my sensor and after a Trace Route, confirms this. The only constant is "abo.wannado.fr",

IP ranges from 80.11.183.56 to 206.81.128.1, tried blocking on my 3500 series router, but that doesn't work because of the IP change. I am tired of seeing this name show up in my alarms,could someone give me an alternative idea on how to "get this person stopped"

The attack is either Nimda or Code Red (II) everytime.This person is not successful, but I still want them gone. ..Help

[r.cheung]

Robert, try using the hostname instead of the IP address in the access list. Make sure that your name servers configured on the router lists one of the DNS servers his ISP uses.

[ali-franks]

Or flag it up to RIPE, send them your FW logs and they should be able to see which user has been allocated the IP address, and take it from there.

Ali

[e.schliesing]

wannado.fr is only SLIGHTLY better at handling abuse reports than rr.com and aol.net, but you COULD null route their ip off to never-never land. Maybe based on DNS is the way to go.