Isn't it bad enough having to worry about hackers?

[SilentRunning]

I recently noticed an increase in the activity of my firewall. So, I decided to take a look at the logs. Among the "Possible port scans" I found several "Probable ports scans" These probable port scans all had the same range. (I have a DSL with a dynamic IP, so is someone doing something bad in these IP ranges?)

Port Scanner/Attacker:


OrgName: DoD Network Information Center
OrgID: DNIC
Address: 3990 E. Broad Street
City: Columbus
StateProv: OH
PostalCode: 43218
Country: US

NetRange: 7.0.0.0 - 7.255.255.255
CIDR: 7.0.0.0/8
NetName: DISANET7
NetHandle: NET-7-0-0-0-1
Parent:
NetType: Direct Allocation
Comment: Defense Information Systems Agency
Comment: DISA /D3
Comment: 11440 Isaac Newton Square
Comment: Reston, VA 22090-5087 US
RegDate: 1997-11-24
Updated: 1998-09-26

RTechHandle: MIL-HSTMST-ARIN
RTechName: Network DoD
RTechPhone: +1-800-365-3642
RTechEmail: HOSTMASTER@nic.mil

OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName: Network DoD
OrgTechPhone: +1-800-365-3642
OrgTechEmail: HOSTMASTER@nic.mil

 

[gentobu]

Its probably just another hacked DoD computer system thats scanning you.

 

[GoodRevrnd]

From what I understand most of this is messenger spam from a spoofed IP (hopefully) on 1025-1029.

 

[SilentRunning]

Originally posted by: gentobu
Its probably just another hacked DoD computer system thats scanning you.

Is that suppose to make me feel better or worse?

 

[SilentRunning]

Originally posted by: GoodRevrnd
From what I understand most of this is messenger spam from a spoofed IP (hopefully) on 1025-1029.

So this is happening to others?

This is a webramp firewall that is reporting it. I have never even seen the "probable port scan" message before just the "possible port scan" one.

 

[FoBoT]

don't be paranoid

 

[olds]

I don't look at my firewall logs. I just let it do it's job.

 

[Jzero]

Originally posted by: oldsmoboat
I don't look at my firewall logs. I just let it do it's job.

There's very little reason for a home user to look at his firewall logs. You get all concerned about what you see, but what you really need to worry about is what you DON'T see.

 

[GoodRevrnd]

Originally posted by: SilentRunning

Originally posted by: GoodRevrnd
From what I understand most of this is messenger spam from a spoofed IP (hopefully) on 1025-1029.

So this is happening to others?

This is a webramp firewall that is reporting it. I have never even seen the "probable port scan" message before just the "possible port scan" one.

Do a google search for "port 50244" and you'll see what I mean.

 

[RyanB18]

It is probably Chloe Obrien at the CTU servers....

 

[zanieladie]

Wow...that's a lot of personal info in your original post.

Be careful!

 

[SilentRunning]

Originally posted by: zanieladie
Wow...that's a lot of personal info in your original post.

Be careful!

Not really personal information. More like publicly available information (ARIN WHOIS)

And I am not paranoid, more of a curiousity. I do realize that most of the possible port scans are benign. It was the fact that it was identified as probable that got my attention in the first place. Furthermore the logs are emailed to my account so I eventually have to read and/or delete them.

*looks around*

What was that? :Q

 

[FreshPrince]

either "someone" bounced a port scan from a compromised dod computer or like the other guy said, it's the messenger thing.

 

[cwdegood]

Originally posted by: GoodRevrnd

Originally posted by: SilentRunning

Originally posted by: GoodRevrnd
From what I understand most of this is messenger spam from a spoofed IP (hopefully) on 1025-1029.

So this is happening to others?

This is a webramp firewall that is reporting it. I have never even seen the "probable port scan" message before just the "possible port scan" one.

Do a google search for "port 50244" and you'll see what I mean.

Rofl, so I searched real quick and got this site Me!.

The last two of the four posts should give you a warm feeling ?
I chuckled.