Being botnetted, need to renew IP quick!

[168pin]

Hey all, looks like I'm being botnetted...

Pages and pages of firewall logs similar to this:

12 April 2006 21:34:58 Unrecognized attempt blocked from 85.187.131.203:31040 to 82.38.168.xx UDP:44043
12 April 2006 21:34:59 Unrecognized attempt blocked from 172.144.228.93:8881 to 82.38.168.xx UDP:44043
12 April 2006 21:35:01 Unrecognized attempt blocked from 85.130.80.9:8453 to 82.38.168.xx UDP:44043
12 April 2006 21:35:02 Unrecognized attempt blocked from 80.175.197.185:6881 to 82.38.168.xx UDP:44043
12 April 2006 21:35:03 Unrecognized attempt blocked from 69.196.192.106:33590 to 82.38.168.xx TCP:44043
12 April 2006 21:35:03 Unrecognized attempt blocked from 202.156.9.71:15626 to 82.38.168.xx UDP:44043

Loads and loads of different IPs, all UDP port 44043..

Router is starting to lose it, keeps throwing me off, and in a window with ping -t www.google.co.uk I keep getting timeouts every 20-30 secs.

Basically, I need a new IP..and quickly...any ideas?

[Chris W]

http://www.cableforum.co.uk/forum/article.php?a=90

hth

[bmxbandit]

the fact that one of the ports is 6881 and one is 8881 makes it look lke it could be something to do with bittorrent... perhaps a tracker somewhere is erroneously pointing at your ip (for whatever reason...)

[grubbymitts]

oh dear, who have you upset on IRC

---------- Post added at 10:37 ---------- Previous post was at 10:36 ----------

Originally Posted by bmxbandit

the fact that one of the ports is 6881 and one is 8881 makes it look lke it could be something to do with bittorrent... perhaps a tracker somewhere is erroneously pointing at your ip (for whatever reason...)

eh? He says it's on UDP port 44043

[bmxbandit]

it's trying to receive data on port 44043, yes... but the computers it's coming from are using various ports, one of which is the standard bittorrent port, and one of whch is suspiciously similar.

might be something completely different, hard to say

[168pin]

Originally Posted by grubbymitts

oh dear, who have you upset on IRC

Actually, I don't think I upset anyone...although I do know some people who supposedly own botnets...

Originally Posted by grubbymitts

eh? He says it's on UDP port 44043

Yeah, I understand the source port is BitTorrent...but I thought BT traffic was TCP rather than UDP?

[James Henry]

Haha.

If you were getting DDoS'd by someone who had a substantial Botnet you think for a second you'd be able to post here?

1 hit on firewall per second certainly isn't an attack, you'd be getting hit with thousands of these a second

Been running any P2P recently? Bittorrent, Limewire, Shareaza, Bearshare, Gnutella, Gnutella 2, etc.

[grubbymitts]

It could also be a worm attack searching through an IP range for open ports with compromised/old versions of programs listening behind it. These wouldn't be as ferocious as a DDOS attack and may be spreading via other people with open P2P ports.

Just an idea.