ClanKiller.com
https://forums.plasmasky.com/

Odd access attempts on Pev's comp
https://forums.plasmasky.com/viewtopic.php?f=8&t=1273
Page 1 of 1

Author:  Mole [ Fri Jun 17, 2005 11:36 am ]
Post subject:  Odd access attempts on Pev's comp

Pev's firewall keeps poping up this message:


The firewall has blocked internet acces to your computer (http) from [dsl-80-46-156-166.access.as9105.com]
(80.46.156.166)
(tcp port 1351)
(tcp flags:s)

Any ideas?

Author:  Rinox [ Fri Jun 17, 2005 4:12 pm ]
Post subject: 

/ me shuts down all activities trying to hack Pev's pc for nude pics of Mole

Author:  Satis [ Fri Jun 17, 2005 4:12 pm ]
Post subject: 

well, the ip address is owned by Tiscali, which is a UK-based ISP. I assume it's your ISP. From the hostname, it sounds like some sort of DSL access device...like a router or multiplexer or something.

TCP port 1351:
equationbuilder 1351/tcp Digital Tool Works (MIT)
equationbuilder 1351/udp Digital Tool Works (MIT)

not sure wtf that is. Somehow I doubt it's related, but who knows.

So, basically it looks like your ISP's DSL access router/switch/multiplexer is attempted to connect to your IP on TCP port 1351 for some reason. Beats me why, but it could be for something as innocuous as checking to see if your DSL modem is still on.

Or it could be someone zombied a computer, spoofed the ip and is attempting to place a trojan horse on her machine via some little-known buffer overflow vulnerability in the TCP/IP stack of her box. All in preparation for a home invasion carried out by 7 Nigerians wearing nothing but ornamental headresses and carrying ipods with the intent of sacrificing you to the ipod gods so their team will win in the olympics.

Author:  Rinox [ Fri Jun 17, 2005 4:50 pm ]
Post subject: 

Did Satis just bare the mysteries of life by linking the primal evilness of the Ipod to the old sacrificial gods of the Dogon? :shock:


The


Answer

Is

Yes

Author:  pevil [ Fri Jun 17, 2005 5:11 pm ]
Post subject: 

rofl well when i clicked 'more info' on the pop up it was saying that it was port 80 that was being attacked and that this port is usually used for webservers which suggests that wahtever was attempting access was a port scanner looking for available ports. *shrugs* either way it was blocked from accessing my computer 3 times today.

edit: 2 more today, from 80.46.182.160 port 4492 and 80.46.198.52 port 3417, both attempts on port 80 again. bastards.

Author:  Satis [ Sun Jun 19, 2005 3:20 am ]
Post subject: 

oh, it's probably your ISP making sure you're not running a web server. That tends to be frowned upon. Not sure why it's checking YOU so often....have odd bandwidth usage habits or something? Anyway, I wouldn't worry about it. Just keep blocking that bitch. In fact, blacklist that IP if your router/firewall lets you.

Author:  pevil [ Sun Jun 19, 2005 7:31 am ]
Post subject: 

heh fair enough. I'm not too worried anyway, simply coz the firewall is blocking (at least some) of them lol. Just damned annoying. *shrugs* my surfing habits haven't changed though; if anything I'm using less bandwidth than usual coz i've been playing morrowind instead of multiplayer sacred... ah well thanks anyway guys

Page 1 of 1 All times are UTC - 6 hours
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/