Handler on Duty: Guy Bruneau
Threat Level: green
Loading...
|
|
Submitted By | Date |
---|---|
Comment | |
2013-01-01 12:55:44 | |
Our ISP was having problems with DNS this evening. While trying to sort that out, I had been trying to detect any funny stuff going on, and so I decided to examine the log on my Linksys router. I noticed I have been getting incoming requests for port 6336. Since the log does not display dates or times, I have no idea how long this has been going on. Here is a cut an paste of the log: 24.214.184.239 6336 24.166.33.23 6336 121.99.54.102 6336 24.166.33.23 6336 68.238.232.13 6336 70.186.213.16 6336 108.225.190.218 6336 115.164.128.40 6336 178.105.3.53 6336 70.118.40.245 6336 66.175.172.245 6336 98.193.226.4 6336 69.161.6.142 6336 70.190.39.116 6336 77.100.148.175 6336 24.214.184.239 6336 90.151.149.173 6336 65.96.230.137 6336 24.166.33.23 6336 218.43.13.29 6336 186.15.20.156 6336 71.192.57.239 6336 186.15.20.156 6336 204.116.235.197 6336 173.24.205.53 6336 173.65.210.138 6336 68.13.248.226 6336 74.47.191.10 6336 186.15.20.156 6336 24.166.33.23 6336 79.97.155.169 6336 97.113.30.191 6336 98.165.10.110 6336 67.165.127.236 6336 79.227.85.163 6336 126.214.58.106 6336 This may be nothing... although it does seem odd that the router is logging these, and they all seem to be headed to this one port, otherwise I'd expect to see others. I checked a few of the originating IPs and figured out they are coming from all over the world, including a user on my own ISP. I thought it might be useful to report this, if for nothing more than future reference. |
CVE # | Description |
---|