#1  
Old 14th December 2007, 16:43
jtheed jtheed is offline
Member
 
Join Date: Jul 2007
Posts: 70
Thanks: 12
Thanked 4 Times in 3 Posts
Default Is someone hacking?

I have started getting messages from my router with the following...

2007-12-13 15:47:04 - SYN with Data - Source:202.108.12.147,4901,WAN - Destination:xxx.xxx.xxx.42,53,LAN


The 4th number in the address is changing from 12, 62, 146 and 147 and the ports are changing as well.

They were coming in last night once every hour or so and lately every few minutes.

Does this mean that someone is trying to hack my DNS?
Reply With Quote
Sponsored Links
  #2  
Old 15th December 2007, 16:17
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,711
Thanks: 1,899
Thanked 2,702 Times in 2,545 Posts
 
Default

Seems like that IP address is using your server for DNS. On the other side, it's an IP from China, so that sure looks suspicious: http://whois.domaintools.com/202.108.12.147
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
The Following User Says Thank You to falko For This Useful Post:
jtheed (16th December 2007)
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
hacking mail? fordwrench General 1 20th May 2007 11:32
TCP/IP through hacking weapons gabrix Suggest HOWTO 3 21st November 2006 22:14
VMWare ESX & Virtual Server Hacking technick Server Operation 1 29th June 2006 23:26


All times are GMT +2. The time now is 09:27.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.