Is it possible to block a specific IP from attempting to connect to screen sharing? I have noticed for some time that the shared screen icon flickers on and off on my menubar every couple of minutes (MacBook Pro, MAC OS X 10.8.4). I thought it was a glitch or a bug. I've checked the console and there are connection attempts almost every minute. 99% are from a specific address:

26/07/13 00:41:51,569 screensharingd[49866]: Authentication: FAILED :: User Name: N/A :: Viewer Address: 89.96.146.134 :: Type: VNC DES


Is this a brute force attack? Should I be concerned? I do need Screen Sharing on, as I connect to this mac quite frequently. I considered activating the Firewall, but it won't help unless I block all incoming connections.

Is there a way to block that IP from connecting at all. The mac is behind an airport extreme router with VNC ports pointed to this mac by NAT. Any way to filter those connections at that level?
If it really is just that one address and no (or few) others and you really don't know a Davide Farci of Verona (that IP address is part of a small subnet assigned to him, small enough to be a personal network or very small office and we'll get back to that shortly) then you can jump through the hoops of setting up a real firewall (e.g. IPTables), either on that system or on your router (the latter is better as it can then take care of other threats).  If that's too much trouble or you really want to do it on that workstation, then I suggest Little Snitch, which can filter both inbound and outbound connections, report on them and, of course, block them (Double Click hasn't managed any traffic to or from this system since I first installed it).  A lot of people use it to stop annoying programs that like to "phone home" and report on them.

Anyway, it's very configurable, very effective and very intuitive.  Recommended for users of all skill levels.

Now, back to Davide Farci.  It may be that he is launching an attack on your system.  That is certainly possible.  However, it is more likely, without knowing any particulars of your situation, that he is just an ordinary gentleman of Verona whose own system has been compromised.  Either way, you should collect those logs and forward them to the security and/or support department of his upstream network provider (send them to abuse@fastweb.it) and they will educate their customer (either by getting him to fix it or booting him off the network, whichever is most appropriate and probably the former).

By the way, all this information is sourced from a whois check on the IP address in your question.  Leaving out most of the RIPE related stuff (RIPE is the European equivalent of ARIN in America and APNIC in Asia and Oceania), there is still this information:


% Information related to '89.96.146.128 - 89.96.146.135'

% Abuse contact for '89.96.146.128 - 89.96.146.135' is 'abuse@fastweb.it'

inetnum:        89.96.146.128 - 89.96.146.135
netname:        FASTWEB-EGLOBALSERVICE_SPA
descr:          EGLOBALSERVICE SPA public subnet
country:        IT
admin-c:        DF3120-RIPE
tech-c:         IRSN1-RIPE
status:         ASSIGNED PA
mnt-by:         FASTWEB-MNT
remarks:        In case of improper use originating from our network,
remarks:        please mail customer or abuse@fastweb.it
source:         RIPE # Filtered

person:         DAVIDE FARCI
address:        CORSO MILANO, 55
address:        VERONA
address:        IT
phone:          +39 0458104705
fax-no:         +39 045577012
nic-hdl:        DF3120-RIPE
source:         RIPE # Filtered

person:         IP Registration Service NIS
address:        Via Caracciolo, 51
address:        20155 Milano MI
address:        Italy
phone:          +39 02 45451
fax-no:         +39 02 45451
nic-hdl:        IRSN1-RIPE
mnt-by:         FASTWEB-MNT
remarks:
remarks:        In case of improper use originating
remarks:        from our network,
remarks:        please mail customer or abuse@fastweb.it
remarks:
source:         RIPE # Filtered

% Information related to '89.96.0.0/16AS12874'

route:          89.96.0.0/16
descr:          Fastweb Networks block
origin:         AS12874
mnt-by:         FASTWEB-MNT
source:         RIPE # Filtered
remarks:
remarks:        In case of improper use originating from our network,
remarks:        please mail customer or abuse@fastweb.it
remarks:

% This query was served by the RIPE Database Query Service version 1.75 (DB-4)


Since there is no email address for Davide Farci, the abuse@fastweb.it address is the one to contact.  Try to resist the temptation that I succumbed to, though, and don't make any obvious references to Shakespeare in your report.  ;)