The Mitsubishi Pajero Owners Club®

stumpey · Posted: Thu Jan 22, 2004 22:29 Post subject: Port Scanning

I don't know who it is but each time I come on Pocuk my pc keeps getting port scanned. You know who you are and I am tracing you down AOL your isp has been informed and logs of your games have been sent to them. I haven't taken this further but I will if it continues all these pipes work both ways..... 8) .
So if nothing else everbody else (the good guys) make sure your security is up to date and you have all the protection, cos somebody in here is not what they seem or they like playing games. I do not get this problem on other sites or when I come in here in the day from work.

Steve

Google · Sponsor

follyman · Guest

Are you sure it is deliberate Steve ? Some servers 'ping' you to see if your still using them as your probably aware, and this may show as a scan on your firewall.
I don't think anyone on the forum can actually get your IP from you just being logged onto here.
It maybe someone is scanning a block of IP's [ the normal way they do it] and your ISP 's range is in that block. They may do it in the evenings which just co-incides with you being here.

Unless of course you have a static IP, [ dont answer that if you reply ]and someone on here knows it, then when they see that you are logged on they are scanning you.

You can hide the fact your logged on in your profile preferences I think.

stumpey · Posted: Thu Jan 22, 2004 23:46 Post subject:

To answer some of the questions....why would AOL want to ping me I would never use them in a million years...I know the difference between a ping and a port scan...I also realise that AOL is probably not the original port of origin....

You can get ip addresses if you have the right tools...

Whether I have a static ip or not I have also used proxies and still get the same problem...

I am also one of the mystery members that have been mentioned recently!! and always have been...dammm blown it

This post was meant as more of a warning to other members rather than a witch hunt it is not a problem to me more an annoyance and I have it under control. If I felt it was a major issue I would have kept my head down and done the business quietly..all this has done is warn
all concerned!!

Steve

Bob_jayne · ** Joined: 13 Nov 2003 Posts: 78 Location: North Notts

stumpey · Posted: Fri Jan 23, 2004 9:52 Post subject:

Thanks Bob

So I am not mr paranoid and this is happening to other members.
The problem is that other members may not be so security conscious and this was the point of my original post.

Steve

Telboy · *** Joined: 03 Mar 2003 Posts: 196 Location: Poole Dorset

Get Zonealarm (or similar), turn off event logging (but not firewall!) and forget all about it. Works for me, only thing is that icon on the task bar flashing away telling me my pc has been port scanned/pinged but is safe...

Terry

stumpey · Posted: Thu Jan 29, 2004 15:37 Post subject:

Sorry Telboy but you seemed to have missed the point....

Steve

Telboy · *** Joined: 03 Mar 2003 Posts: 196 Location: Poole Dorset

marcsparks · Posted: Thu Jan 29, 2004 16:43 Post subject:

Usefull utility i run along side zonealarm http://www.visualizesoftware.com/

Marc 8)

Telboy · *** Joined: 03 Mar 2003 Posts: 196 Location: Poole Dorset

Thanks Marc

Do you run XP? as in the FAQ it suggests not supported officially. Not bad for freeware though.

regards

Terry

marcsparks · Posted: Thu Jan 29, 2004 18:46 Post subject:

hi i run win 98 sr2 moor reliable lol

marc

Trig · ****** Joined: 24 Nov 2002 Posts: 1379 Location: N. Cyprus

Yes... some Cyber thug is around!! My firewall goes mad when on PoCUK... got the point of Stumpey which is KEEP your eyes open! Don't want to start a Panic as the attempts of the "thug" seem amateur so far... albeit annoying!

Marc,... abandoning the Pajero!!?? Sad

bperfrement · Posted: Wed Feb 18, 2004 14:51 Post subject:

I'll have to check my firewall logs more often and see if it happens to me too.

Ginja Nutz · Posted: Sat Feb 21, 2004 7:15 Post subject:

.
In the 2 mins it took me to read through this forum my firewall log showed that it blocked 7 'Incoming TCP' s, each had a different IP address or port reference !
Someone is having trying to have a lookey see !! Shocked

bperfrement · Posted: Sat Feb 21, 2004 17:42 Post subject:

Hmm, just been monitoring by firewall logs; not what I'd call a port scan, just attempted connections to port 135 (Windows RPC), Port 135 is essential to the functionality of Active Directory and Microsoft Exchange mail servers, among other things.

This could be a problem if you have either Exchange or run Windows 2K or XP which I beleive use Active Directory. There's also a virus which attempts to use this port to do evil things.

Which ports are you seeing being opened?