According to my router logs, someone at IP 71.154.243.231 is knocking
on port 39726 every few minutes. I don't know for how long this has
been going on (the router log is not very deep). I also don't know if
it's TCP or UDP.
Very sketchy info that port 39726 might have something to do with VPN
- anyone know for sure?
Any central list of ports used by known malware, botnets, etc?
Virus Guy
news:46F47D4C.ADBA08EE@Guy.com:
> According to my router logs, someone at IP 71.154.243.231
> is knocking on port 39726 every few minutes. I don't know
> for how long this has been going on (the router log is not
> very deep). I also don't know if it's TCP or UDP.
>
> Very sketchy info that port 39726 might have something to
> do with VPN - anyone know for sure?
>
> Any central list of ports used by known malware, botnets,
> etc?
>
Try
http://isc.sans.org/port_details.html?port=X,
where 'X' is a port number
(it's a hit-or-miss).
j
--
Replies to: Nherr1professor2doktor31109(at)Oyahoo(dot)Tcom
"Virus Guy"
news:46F47D4C.ADBA08EE@Guy.com...
> According to my router logs, someone at IP 71.154.243.231 is knocking
> on port 39726 every few minutes. I don't know for how long this has
> been going on (the router log is not very deep). I also don't know if
> it's TCP or UDP.
>
> Very sketchy info that port 39726 might have something to do with VPN
> - anyone know for sure?
>
> Any central list of ports used by known malware, botnets, etc?
Below is the WhoIs info. Use the abuse address:
OrgName: AT&T Internet Services
OrgID: SIS-80
Address: 2701 N. Central Expwy # 2205.14
City: Richardson
StateProv: TX
PostalCode: 75080
Country: US
NetRange: 71.128.0.0 - 71.159.255.255
CIDR: 71.128.0.0/11
NetName: SBCIS-SIS80
NetHandle: NET-71-128-0-0-1
Parent: NET-71-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.PBI.NET
NameServer: NS2.PBI.NET
Comment: Contact IPAdmin-PBI@sbcis.sbc.com for general IP
Comment: support. Contact support@pacbell.net for technical support
issues. Contact
Comment: abuse@pacbell.net for policy abuse issues.
RegDate: 2005-01-11
Updated: 2007-05-25
RTechHandle: PIA2-ORG-ARIN
RTechName: IPAdmin-PBI
RTechPhone: +1-800-648-1626
RTechEmail: pbiip@txmail.sbc.com
OrgAbuseHandle: ABUSE6-ARIN
OrgAbuseName: Abuse - Southwestern Bell Internet
OrgAbusePhone: +1-800-648-1626
OrgAbuseEmail: abuse@sbcglobal.net
OrgNOCHandle: SUPPO-ARIN
OrgNOCName: Support - Southwestern Bell Internet Services
OrgNOCPhone: 800-648-1626
OrgNOCEmail: support@swbell.net
OrgTechHandle: IPADM2-ARIN
OrgTechName: IPAdmin-SBIS
OrgTechPhone: 800-648-1626
OrgTechEmail: support@swbell.net
CustName: PPPoX Pool - rback18.hstntx
Address: 2701 W. 15th St.
Address: PMB 236
City: Plano
StateProv: TX
PostalCode: 75075
Country: US
RegDate: 2006-02-15
Updated: 2006-02-15
NetRange: 71.154.242.0 - 71.154.243.255
CIDR: 71.154.242.0/23
NetName: SBCIS-021506074651
NetHandle: NET-71-154-242-0-1
Parent: NET-71-128-0-0-1
NetType: Reassigned
Comment:
RegDate: 2006-02-15
Updated: 2006-02-15
RTechHandle: PIA2-ORG-ARIN
RTechName: IPAdmin-PBI
RTechPhone: +1-800-648-1626
RTechEmail: pbiip@txmail.sbc.com
OrgAbuseHandle: ABUSE6-ARIN
OrgAbuseName: Abuse - Southwestern Bell Internet
OrgAbusePhone: +1-800-648-1626
OrgAbuseEmail: abuse@sbcglobal.net
OrgNOCHandle: SUPPO-ARIN
OrgNOCName: Support - Southwestern Bell Internet Services
OrgNOCPhone: 800-648-1626
OrgNOCEmail: support@swbell.net
OrgTechHandle: IPADM2-ARIN
OrgTechName: IPAdmin-SBIS
OrgTechPhone: 800-648-1626
OrgTechEmail: support@swbell.net
# ARIN WHOIS database, last updated 2007-09-22 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
Bob S.