Chinese hacker

50Twuncle

I keep on finding that 218.77.79.43 is trying to gain access to my router - from my router logs - (my PC's are turned off overnight)
This regularly occurs between 00:00 and 01:00


Apparently 218.77.79.43 is a common hacking address
Whois - says that it is Chinese

It shows as a SECURITY WARNING on my TT fibre router


"Intrusion -> SRC=218.77.79.43 DST=**.**.**.** LEN=40 TOS=0x00 PREC=0x00 TTL=234 ID=54321 PROTO=TCP SPT=35322 DPT=25 WINDOW=65535 RES=0x00 SYNURGP=0"


Is there anything to concern me in this ?
nb **.**.**.** is my own IP address


ie Is the router protecting me or is it giving access ?

Roland_Sausage

The router's firewall is probably doing it's job. Nothing to be concerned about.

PS, there is no need to obscure your own IP address as little can be done with this.

stator

You could just add a permanent block on that IP just in case, or perhaps a whole range of IP addresses.

50Twuncle

stator wrote: »

You could just add a permanent block on that IP just in case, or perhaps a whole range of IP addresses.

Good Idea !!
thanks

somersethillbilly

50Twuncle wrote: »

Apparently 218.77.79.43 is a common hacking address
Whois - says that it is Chinese

50Twuncle

Thanks - very disconcerting !!
and Who said all Chinese look alike ?

somersethillbilly

Where was your router manufactured? China? The good folks in the picture were probably just doing a "helpful" firmware update

50Twuncle

somersethillbilly wrote: »

Where was your router manufactured? China? The good folks in the picture were probably just doing a "helpful" firmware update

Good point - thanks - I can stop worrying now !!

Strider590

It's most likely just normal traffic, you visit a website, that site has ads, these ads are hosted all over the world.
Could be some software you have installed.
Could be your router "phoning home" (i've heard some Chinese made ISP routers have been identified as having possible backdoors).

It could be a million different things.

There are 4.2 Billion IPv4 addresses, why would anyone target you specifically?

Being concerned for security is good, but paranoia because of something you don't understand (especially when the media has been winding people up), is very bad.

The tabloid press has actually used the information you've presented here, to create or back up completely false news articles, designed to stir up paranoia and fear of the internet.

John_Gray

Strider590 wrote: »

Could be your router "phoning home".

Surely not if the attempted access is incoming?
Otherwise they are 'phoning' themselves!

50Twuncle

Google 218.77.79.43 and see what you think ....