Keep getting Port Scanned by RPF

[rocketeer25]

The staff has been and will continue to work with Invision on these kind of issues...

The latest from Invision:

Hello,

There is nothing running on your server on either of those ports, or any portscanner for that matter. Usually when someone is portscanning a machine they will "spoof" or fake the originating ip address. This is most likely the case here as there is no portscanner software on your server.

Thank you,

Blake
System Administrator
Invision Power Services

 

[Kerr Avon]

Spoofing is entirely possible, wonder why it's just hitting amish though?

 

[amish]

Kerr, others have reported it as well on the first page of this thread.

Spoofing is a possibility, next time it happens, I will be sure to be on the ready to track the IP through hell and high water.

 

[Kerr Avon]

Fair enough, but not many people are being hit by it. I haven't gotten any alerts, though there are several levels on my security that would block it even before getting to my computer. Do you have a hardware firewall, router, or any form of network?

 

[amish]

Running Agnitum Outpost as my Firewall with a Linksys router w/ hw firewall

 

[Kerr Avon]

Originally posted by amish@Jul 15 2005, 11:32 PM
Running Agnitum Outpost as my Firewall with a Linksys router w/ hw firewall

[snapback]1034510[/snapback]​

Not really familiar with that firewall, still getting hit with it?

 

[amish]

I havent experienced a hit in over a week, then again, I usually do all my browsing at work and only about an hour or two at home.

Yes, I do work. I multi-task

 

[amish]

Wanted to say I got hit last night with another scan, I will try and get the information later today. Sorry I did not post the info last night.

Take care.

 

[amish]

Update 10/11/05 (Today)

IP Address 67.15.145.9
Attacker DNS www.rpf.invisionzone.com
Attack Type Port scanned
Attack Time 3:01:24 PM EST
Scan Port Details TCP (3884, 3883)

 

[amish]

Possibly, by why would someone choose to spoof an IP from Invisionzone and why would the attack only come when I am connected to the RPF.

 

[amish]

Its really no problem to me. I just want you to be aware of it in case it became a problem.

Just trying to share

 

[amish]

I have been wondering if it is some type of Ad thing. I cannot really explain it, and I am 99% sure my machine is spyware free, but being Ad related would make some sense.

Besides, other members had the same problem so it could be just as simple as that.

Hmmmm