b3ta.com board
You are not logged in. Login or Signup
Home » Messageboard » XXX » Message 1310400 (Thread)

# waarh a bit scarey... i like all your small paintmashes :)
TJ who is :
212.159.93.151/
and why are they scanning my firewall so much?
(joshwa ultra lurker, Mon 2 Jun 2003, 20:26, archived)
# eep!
212.159.93.151/piccies/face-painting-butterfly.jpg
(I helped save b3ta! bananaman, Mon 2 Jun 2003, 20:26, archived)
# who that?
(joshwa ultra lurker, Mon 2 Jun 2003, 20:27, archived)
# that's whoever's
been scanning your firewall
(I helped save b3ta! bananaman, Mon 2 Jun 2003, 20:28, archived)
# mabe he's a fellow b3tan?
212.159.93.151/tim/
(joshwa ultra lurker, Mon 2 Jun 2003, 20:29, archived)
# It's me
And whenever I see anybody post their home connection IP address, ANYWHERE, I scan it and let them know of any obvious problems.

You will also see from the scans that they're SYN scans only and I never, ever attempt to connect().

I help out with a number of tech forums, and you wouldn't believe the number of people that just hook up a PC to the 'net on broadband and leave it WIDE open.

I assure you, nothing malicious intended, just a health check.
(Brian Blessed, Mon 2 Jun 2003, 20:38, archived)
# wow! thanks for letting me know.
did you find anything?
//edit what about all the other people on the forum who probably don't even have a firewall?
//edit2 - do you recommend a firewall (like zonealarm) on my webserver as well? (see profile for network diagram)
(joshwa ultra lurker, Mon 2 Jun 2003, 20:38, archived)
# You can do it yourself and see the results
Click Me Sonny!
(I helped save b3ta! partychancer, Mon 2 Jun 2003, 20:47, archived)
# thanks very much :)
ta
(joshwa ultra lurker, Mon 2 Jun 2003, 20:56, archived)
# No probs
:)
(I helped save b3ta! partychancer, Mon 2 Jun 2003, 20:58, archived)
# Odd
I thought I'd already replied to this, but it has disappeared...

No, nothing there - you look pretty safe.

One obvious comment - lots of "closed" ports, rather than "stealth". Don't know what firewallage you have, don't post details here!!!

I didn't do a full 1-65535 port scan, so my results are incomplete.

Go to grc.com and look for "shields up" to test yourself too.

Best regards,

Bern
(Brian Blessed, Mon 2 Jun 2003, 21:09, archived)
# 212.159.*.*
I believe is the plusnet IP range?

edit: it is - I'm 212.159.20.40 and I have other friends who are also 212.159.*.*
(I helped save b3ta! dogsbollocks, Mon 2 Jun 2003, 20:28, archived)
# what is he 'scanning' exactly?
portscan him back
(I helped save b3ta! munkt0n, Mon 2 Jun 2003, 20:30, archived)
# Hehee
Childish behaviour for geeks :)

'don't let the older boys bully you - port scan them back'
(I helped save b3ta! dogsbollocks, Mon 2 Jun 2003, 20:30, archived)
# loads
source 212.159.93.151 44424 dest. 80.193.33.22 667 ports : 699 659 499 378 560 208 1014 306 950 667 699 38 681 1020 747 111 533 513 etc also : 705 AgentX for SNMP
(joshwa ultra lurker, Mon 2 Jun 2003, 20:33, archived)
# he's after me socks!!!
port 1080 SOCKS
(joshwa ultra lurker, Mon 2 Jun 2003, 20:37, archived)