I'd suggest reporting the activity to your local ISP. They may choose to do nothing, but that's up to them. other than that, perhaps set up an ACL to only allow established connections for that subnet from the Ukraine? Or heck, Supernet if you're unsure what range of addresses you're dealing with. Unless there's a legitimate reason for users from that block of addresses to be accessing your network, just lock them out unless something inside requested the packet delivery.
__________________
Don't mind me. I'm just releasing the insanity pressure from my headvalves.
|