Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I saw in the logs of my server that an IP was repeatedly trying to logon as sa onto my SQL Server. The ip is: it resolves back to

Is there anyway to find out from Comcast who owns this box?

share|improve this question

You'll want to report the problem to Comcast and your ISP. They won't tell you who it is, but they may either contact the user or disconnect them.

Odds are they won't to anything. You shouldn't leave your SQL Server on the public Internet. I recently blogged about this exact thing.

share|improve this answer
+1 for reporting him – Ben S Oct 9 '09 at 18:25
Most attacks are launched from already hacked servers. So I think it's unlikely that the person responsible for this is at that IP. This is why ISPs will do nothing. But I say report the problem and hope that Comcast will notify their customer of the issue so that they can sort it out on their end. Beyond that block that IP address from accessing your SQL Server and come up with a good reason to have your SQL Server on the web and available to everyone. If you can't come up with a good reason then fix your attack surface area by protecting your server better. – 3dinfluence Oct 9 '09 at 19:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.