Recent server hacks - message flooding

Hi all sorry was not about when all this kicked off...........

Anyway looks like a single player on ip's of -:
71.203.74.232 name Www.alliedassault.tk
174.56.223.203 name Www.alliedassault.tk & www.alliedassault.webs.com
76.73.212.180 name www.alliedassault.webs.com

Was being a flocker noob - anyway had a few choices for AAAA we cant go round adding bans via every server we host so my first thoughts were to use windows MMC to blck on our dedi;s - well which I have used before but a bit long winded to say the least...........

Use Windows to block IP's and IP ranges
If you dont have control over a router or firewall you can block IP's at the server via Windows.

Click 'Start' > 'Run' >type 'MMC' press ok.

In the console click > 'File' > 'Add/Remove Snap in'

In the 'Standalone Tab' click The 'add' button

Seclect 'IP Security Policy Managment' > 'ADD' > 'Local Computer' > 'finish' > 'close' > 'ok'

You should now be back to the console.

In the left frame right click 'IP security policies on local computer' > 'Create IP security policy'

Click Next and then name your policy 'Block IP' and type a description.

Click 'Next' then leave 'activate' ticked then click 'Next'

leave the 'edit properties ticked and click 'Finish'

You should now have the properties window open.

Click 'ADD' then click 'Next' to continue.

Leave 'This rule does not specify a tunnel' selected and click 'next'

Leave 'all network connections' selected and click 'next'

You should now be on the IP filter list. You need to create a new filter, so dont select any of the default ones. Click 'ADD'

Type a Name for your list, call it 'IP block list'
Type a description in, can be same as name.
Click 'ADD' then click 'Next' to continue.

In the description box type a description. As its the first IP you are blocking call it 'IP1' or 'IP Range 1'
Leave ticked the 'Mirrored. Match packets with the exact opposite source and destination addresses'
Click 'Next'

The 'Source address' should be left as 'My IP address' click 'Next'

You can now select 'A Specific IP address' or 'A Specific Subnet' for the Destination address.
Type in the IP address you want to block and if blocking a subnet type in the subnet block. Click 'next'

Leave the protocol type as 'Any' and click 'Next' and then 'Finish'

You have now blocked your first IP or IP range.

Windows firewall has no GUI to do anything about IP's really so I spoke with Gaming Deluxe and they mainly use MMC on WIndows servers so found this -:
http://www.peerblock.com/

It does a lot of other stuff but you can create your own block lists

Anyway - I cant give the clans direct access BUT if you get a multi pain in the rear across servers then message me and I will add him to the ban list!!! This cant be used and shouldnt!! for oneoff blocks for individual servers unless it is major bad - you should use your own Server block such as reborn or SCAPP BUT we will block if its a major issue.

At present only me who can do it but will role out to AAAA Admins............

So for this scum bag here's some info -:
Contact Email

Whois Data
NetRange: 174.56.192.0 - 174.56.255.255
CIDR: 174.56.192.0/18
OriginAS:
NetName: AUGUSTA-10
NetHandle: NET-174-56-192-0-1
Parent: NET-174-48-0-0-1
NetType: Reassigned
RegDate: 2009-10-19
Updated: 2009-10-19
Ref: http://whois.arin.net/rest/net/NET-174-56-192-0-1

CustName: Comcast Cable Communications, Inc.
Address: 1800 Bishops Gate Blvd
City: Mt Laurel
StateProv: NJ
PostalCode: 08054
Country: US
RegDate: 2009-10-19
Updated: 2011-03-19
Ref: http://whois.arin.net/rest/customer/C02341832

OrgAbuseHandle: NAPO-ARIN
OrgAbuseName: Network Abuse and Policy Observance
OrgAbusePhone: +1-856-317-7272
OrgAbuseEmail:
OrgAbuseRef: http://whois.arin.net/rest/poc/NAPO-ARIN

OrgTechHandle: IC161-ARIN
OrgTechName: Comcast Cable Communications Inc
OrgTechPhone: +1-856-317-7200
OrgTechEmail:
OrgTechRef: http://whois.arin.net/rest/poc/IC161-ARIN

RTechHandle: IC161-ARIN
RTechName: Comcast Cable Communications Inc
RTechPhone: +1-856-317-7200
RTechEmail:
RTechRef: http://whois.arin.net/rest/poc/IC161-ARIN

RAbuseHandle: NAPO-ARIN
RAbuseName: Network Abuse and Policy Observance
RAbusePhone: +1-856-317-7272
RAbuseEmail:
RAbuseRef: http://whois.arin.net/rest/poc/NAPO-ARIN

NetRange: 174.48.0.0 - 174.63.255.255
CIDR: 174.48.0.0/12
OriginAS:
NetName: JUMPSTART-5
NetHandle: NET-174-48-0-0-1
Parent: NET-174-0-0-0-0
NetType: Direct Allocation
RegDate: 2008-11-18
Updated: 2010-02-01
Ref: http://whois.arin.net/rest/net/NET-174-48-0-0-1

OrgName: Comcast Cable Communications, Inc.
OrgId: CMCS
Address: 1800 Bishops Gate Blvd
City: Mt Laurel
StateProv: NJ
PostalCode: 08054
Country: US
RegDate: 2001-11-29
Updated: 2009-11-06
Ref: http://whois.arin.net/rest/org/CMCS

OrgAbuseHandle: NAPO-ARIN
OrgAbuseName: Network Abuse and Policy Observance
OrgAbusePhone: +1-856-317-7272
OrgAbuseEmail:
OrgAbuseRef: http://whois.arin.net/rest/poc/NAPO-ARIN

OrgTechHandle: IC161-ARIN
OrgTechName: Comcast Cable Communications Inc
OrgTechPhone: +1-856-317-7200
OrgTechEmail:
OrgTechRef: http://whois.arin.net/rest/poc/IC161-ARIN

RTechHandle: IC161-ARIN
RTechName: Comcast Cable Communications Inc
RTechPhone: +1-856-317-7200
RTechEmail:
RTechRef: http://whois.arin.net/rest/poc/IC161-ARIN

RAbuseHandle: NAPO-ARIN
RAbuseName: Network Abuse and Policy Observance
RAbusePhone: +1-856-317-7272
RAbuseEmail:
RAbuseRef: http://whois.arin.net/rest/poc/NAPO-ARIN
174.56.223.203 Website Information

Title: 401 Unauthorized
Description: n/a
Keywords: n/a
174.56.223.203 Server Details

IP address: 174.56.223.203
Server Location: Augusta, GA in United States
ISP: Comcast Cable

174.56.223.203 server location:
Augusta in United States
Map data ©2011 Google - Terms of Use