Skynet Am I blocking hacking attempts?

[cc666]

This is continuous on my GT-BE-98PRO log, every few seconds.

Jan 23 10:00:10 kernel: [BLOCKED - INBOUND] IN=vlan4094 OUT= (followed by a mac address)

Is this an external hack attempt being blocked?

CC

 

[ColinTaylor]

Is this an external hack attempt being blocked?

Impossible to say without seeing the source address(es) and knowing the port. Probably just port scanning.

Is vlan4094 your WAN interface?

 

[cc666]

Impossible to say without seeing the source address(es) and knowing the port. Probably just port scanning.

Is vlan4094 your WAN interface?

That VLAN is a hardwire to an LG TV with a firestick. I have another VLAN hardwired to another LG TV with a firestick that is clean, no blocks.

Here is more info:

Jan 23 10:00:09 kernel: [BLOCKED - INBOUND] IN=vlan4094 OUT= MAC=xxxxxxxxxxxxx SRC=78.128.114.130 DST=ROUTER IP ADDRESS)( LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=26759 PROTO=TCP SPT=57643 DPT=33333 SEQ=2660700893 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0

CC

 

[ColinTaylor]

Looks like normal port scanning. Do you see scans from other IP addresses? Perhaps you are you blocking Bulgaria in Skynet?

https://www.abuseipdb.com/check/78.128.114.130

 

[cc666]

Looks like normal port scanning. Do you see scans from other IP addresses? Perhaps you are you blocking Bulgaria in Skynet?

https://www.abuseipdb.com/check/78.128.114.130

When I check the ip address 78.128.114.130 I get this: Other search results also indicate as malicious.

CC

 

[ColinTaylor]

When I check the ip address 78.128.114.130 I get this: Other search results also indicate as malicious.


View attachment 70043

CC

Like I said, that's normal port scanning. Nothing that's specifically targeting you. If you didn't have Skynet installed your router's built-in firewall would have dropped the traffic.