[rescue] IP blocks

[Patrick Giagnocavo]

On Mon, Feb 18, 2002 at 08:27:46PM -0600, Phil Schilling wrote:
> Eric Dittman wrote:
>  
> > Actually, hacker-hell.  I get a lot of attempts to break in
> > from *.wanadoo.fr.  I also see a lot from *.t-dialin.com.
> > --
> 
> Got called in about two weeks ago for a web server breakin that had some of
> these ip's involved.

I fixed up a guy that had breakins from a couple of Romanian dialup
accounts just the other week.

And you should be able to query everything for *.wanadoo.fr by digging
around.  The host and dig utils can get at least some of the info you
need.

If not, you can query and get all the netblocks owned by wanadoo.
That might be enough.

eg, see

http://www.uwhois.com/cgi/whois.cgi?User=NoAds&query=193.252.19.10

./patrick