Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I saw in the logs of my server that an IP was repeatedly trying to logon as sa onto my SQL Server. The ip is: 75.145.243.233 it resolves back to 5-145-243-233-richmond-va.hfc.comcastbusiness.net.

Is there anyway to find out from Comcast who owns this box?

share|improve this question

1 Answer 1

You'll want to report the problem to Comcast and your ISP. They won't tell you who it is, but they may either contact the user or disconnect them.

Odds are they won't to anything. You shouldn't leave your SQL Server on the public Internet. I recently blogged about this exact thing.

share|improve this answer
1  
+1 for reporting him –  Ben S Oct 9 '09 at 18:25
    
Most attacks are launched from already hacked servers. So I think it's unlikely that the person responsible for this is at that IP. This is why ISPs will do nothing. But I say report the problem and hope that Comcast will notify their customer of the issue so that they can sort it out on their end. Beyond that block that IP address from accessing your SQL Server and come up with a good reason to have your SQL Server on the web and available to everyone. If you can't come up with a good reason then fix your attack surface area by protecting your server better. –  3dinfluence Oct 9 '09 at 19:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.