I run a website, sell discs and stuff, and pay a company called Postcode Anywhere so customers can fill in their address by entering a postcode when they check out.

Just had a security alert that someone has tried to use my Postcode Anywhere account (and hence credits) on their own website, or another website other than my own.

The IP address which attempted to do this was 212.219.24.30.

That comes up as SPAIN, CANARY ISLANDS, PUERTO DE LA CRUZ

ISP = ST HELENS COLLEGE

So at first I thought there is a St Helens College in Spain, but I can't find one on the net. Is it someone in the St Helens College in Merseyside trying to hack me and hiding there tracks via Spain?, or someone in Spain using a none Spanish ISP? or is it a load of rubbish and I should just ignore it?

Also had a lot of dodgy emails to my Webmaster email address this week.

Any help or advice appreciated, cheers.

Martin

A whois turned up the following:

person: Sue Brooks

address: ST Helens

address: Brook Street, ST Helens

address: Merseyside, WA10 1PZ

phone: +44 1744 623223

nic-hdl: SB3336-RIPE

mnt-by: JIPS-NOSC

source: RIPE # Filtered

person: John Taylor

address: St Helens College

address: Brook Street

address: St Helens

address: Merseyside

address: WA10 1PZ

address: England, UK

phone: +44 1744 623261

fax-no: +44 1744 623412

nic-hdl: JT287-RIPE

mnt-by: AS1849-MNT

source: RIPE # Filtered

Chris

looks like a scouser to me:

http://www.ripe.net/whois?form_type=simple&full_query_string=&searchtext=212.219.24.30&do_search=Search

RIPE contact details for this IP range is:

name: John Taylor

address: St Helens College

address: Brook Street

address: St Helens

address: Merseyside

address: WA10 1PZ

address: England, UK

phone: +44 1744 623261

fax-no: +44 1744 623412

ring him up and ask him what someone on his network's playing at...

looking at it, its the st helens college gateway using net north west as a provider.

http://www.netnw.net.uk/

the final hop being

17 106 105 105 194.66.20.74 gw-sthelens-college.netnw.net.uk

This is great information, who are those people likely to be?

Thanks everyone:thumbup:

the names above are the designated contacts for the network using those IP blocks. they're either techies or IT managers, usually. i'd imagine one of their students is playing silly buggers - a quick phone call to the contacts above would probably successfully browntrouser the little scroats...particularly if you start saying things like "attempted abuse of commercial system for personal gain", "actionable" and "computer misuse act" etc

I called the college, the named people didn't have a clue what I was talking about. Though I got some sense from someone on the IT helpdesk, who was very helpful and looked in to it for quite a while.

Traced to a student computer, looked like they'd try save the postcode finder pop-up as a favourite, which of course wont work when accessed outside of my website.

I'm happy it's nothing sinister, thanks for the help peeps!

Just a thought, but is it worth reporting it to Postcode Anywhere? Possibly not if your security prevented misdoing, but it might be good to hear what protection against hacking is inbuilt into their system. I guess they will naturally say 100% security, but might be worth asking the question?

Regards

Mo