Is it just us, or do a lot of port scans seem to come from Romania? I've caught two just this past week. I think I am going to find every Romanian netblock I can and add them to my deny list on our routers.

Originally posted by uuallan
Is it just us, or do a lot of port scans seem to come from Romania? I've caught two just this past week. I think I am going to find every Romanian netblock I can and add them to my deny list on our routers.

Yeah, it seems that the popular proxy's people use for port scanning and whatnot, are all in Romania and Russia... Granted, other countries too, but Romania seems to be one of the most popular I've seen.

We are in Italy and we also have A LOT of portscan and ftp login attempts from romania.
Anyone knows where I can find romanians netblocks so that I can add them to my deny list?

From what I last heard, hacking in Romainia is either legal or if it is illegal, it is simply not enforced. As a result there are a lot of anonymizer gateways setup in Romainia that are used for hacking. We get daily scans on our networks from Romainia, China, and other countries where hacking is tolerated.