How can i understand the domain that banned ip belongs to ..?

[CyberTKQ]

Hi,
I am directAdmin user as a hostinG Firm Administrator(Admin Level).
I think, somebody makes ddos attack to my server. Because, i am taking e-mails from firewall like this;

Banned the following ip addresses on Sun Oct 28 01:40:01 EEST 2007

88.238.118.215 with 1279 connections

I want to learn this,
How can i understand the domain that banned ip belongs to ?
Namely, which domain was attacked with ddos ?
Thanks, TKQ.

 

[megahoster.net]

Hi,

Namely, which domain was attacked with ddos ?

tcpdump -npi eth0 port domain

 

[megahoster.net]

I have installed APF
make

netstat -ntu | awk '{print $5}'| cut -d: -f1 | sort | uniq -c | sort -nr | more

If from IP more 100-200 connections
/etc/apf/apf -d IP

 

[nobaloney]

Hi,
How can i understand the domain that banned ip belongs to ?

From the linux/unix command line:

$ whois 88.238.118.215

will tell you who owns the IP#.

If the IP# has reverse DNS set for it, you can find the domain associated with it in reverse DNS with:

dig -x 88.238.118.215

But Reverse DNS is often out of date and this should not be considered definitive unless then doing a dig on the returned response points to the same IP#.

Jeff

 

[CyberTKQ]

-

Hi,
Thanks for your interests. But i think, i told it wrongly.

Someone made a ddos attack to a website. And the firewall sent me an e-mail like as i wrote - attacker ip address. - . I want to learn which site was attacked ? Namely, which site that domain clicked and attacked ?

Re-Thanks, ..