cancel
Showing results for 
Search instead for 
Did you mean: 

Port scanned, plus net user ?

N/A

Port scanned, plus net user ?

Not sure about this but my firewall says ....

IP 212.159.124.*** scanned ports 2745, 1025, 445, 3127 and 6129

Is this somebody being naughty or a mistake ?
Can I get something done about it ?
What does the ports do ?

Thanks.
6 REPLIES
Community Veteran
Posts: 14,469
Registered: 30-07-2007

Port scanned, plus net user ?

Please send details of what you are seeing plus your firewall log showing the scans to abuse@plus.net and it will be dealt with. It is likely to be an infected PC which the owner is not aware of it.

We have had several similar threads on this:

http://portal.plus.net/central/forums/viewtopic.php?t=15800

http://portal.plus.net/central/forums/viewtopic.php?t=15786

http://portal.plus.net/central/forums/viewtopic.php?t=15934

Some links to find out what the ports are used for:

http://www.iana.org/assignments/port-numbers and http://ccr.i2.nscee.edu/port/ contain info about port uses, the second you can search for multiple uses.
Community Veteran
Posts: 3,181
Thanks: 19
Fixes: 2
Registered: 31-07-2007

Port scanned, plus net user ?

There lots more than there should be, so I'm putting a pc in to DMZ for a day or two. Going to log all PN users and mail them as I did for Blaster when it came out initially.
Unvalued customer since 2001 funding cheap internet for others / DSL/Fibre house move 24 month regrade from 8th May 2017
N/A

Re: Port scanned, plus net user ?

Quote

IP 212.159.124.*** scanned ports 2745, 1025, 445, 3127 and 6129

From what I've been reading scans on these ports are a likely indication of a PC being infected by one of the Gaobot/Agobot/Phatbot family of worm viruses.

Potentially bad news for these people if this is the case as it provides a backdoor for somebody to access their machine...

Mark.
N/A

Port scanned, plus net user ?

Anybody heard of industry58, tracert to IP address in firewall log points to industry58.force9.co.uk :x Ticket raised, awaiting reply.
Community Veteran
Posts: 3,181
Thanks: 19
Fixes: 2
Registered: 31-07-2007

Port scanned, plus net user ?

Quote
Anybody heard of industry58, tracert to IP address in firewall log points to industry58.force9.co.uk :x Ticket raised, awaiting reply.


dont wait for a reply from an abuse ticket, you won't get one unless that person in your logs tried to attack your modem/router
Unvalued customer since 2001 funding cheap internet for others / DSL/Fibre house move 24 month regrade from 8th May 2017
Community Veteran
Posts: 14,469
Registered: 30-07-2007

Port scanned, plus net user ?

PlusNet have stated in several threads they can't always reply to all abuse reports due to the number of them they get but they do still investigate and if necessary contact the offending person to take action to stop the activities.