My server has been scanned, what should I do now?

I have installed Bastille Firewall + PSAD

And now I receive many many email from PSAD that tell me my server has been scanned.

The source IPs are 66.197.217.11 and 66.197.217.12

So, what should/can I do now? Can I complain with shawn@hostnoc.net

Thanks! My server has been scanned, what should I do now?


Below is one of the emails:

=-=-=-=-=-=-=-=-=-=-=-=-=-= Jan 4 21:02:19 =-=-=-=-=-=-=-=-=-=-=-=-=-=
psad: Portscan Detected on server1.xxxxx.net (66.246.xxx.xxx).

Source: 66.197.217.11
Destination: 66.246.xxx.xxx
Newly scanned UDP ports: [53559] (since: Jan 4 21:02:19)
Newly Blocked UDP packets: [1] (since: Jan 4 21:02:19)
Complete TCP/UDP port range: [41865-53559] (since: Jan 4 06:01:48)
Total blocked packets: 50
Start time: Jan 4 06:01:48
End time: Jan 4 21:02:19
Danger level: 2 out of 5
DNS info: 66.197.217.11 -> No reverse dns info available


=-=-=-=-=-=-= Whois Information: =-=-=-=-=-=-=

OrgName: Network Operations Center Inc.
OrgID: NOC

NetRange: 66.197.128.0 - 66.197.255.255
CIDR: 66.197.128.0/17
NetName: HOSTNOC-2BLK
NetHandle: NET-66-197-128-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.HOSTNOC.NET
NameServer: NS2.HOSTNOC.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2001-11-01
Updated: 2002-02-27

TechHandle: ZMA1-ARIN
TechName: Arcus
TechPhone: +1-570-784-2491
TechEmail: shawn@hostnoc.net

# ARIN Whois database, last updated 2003-01-03 20:00
# Enter ? for additional hints on searching ARIN's Whois database.

 

 

 

 

Top