What is this? Log from router

[brainosas]

Hi, I have RT-N66U with Merlin RT-N66U_3.0.0.4_374.40_alpha4 installed. Now I've logged to my router and found this in my log:

Feb 28 08:39:59 pptpd[2209]: CTRL: Client 183.60.48.25 control connection started
Feb 28 08:39:59 pptpd[2209]: CTRL: EOF or bad error reading ctrl packet length.
Feb 28 08:39:59 pptpd[2209]: CTRL: couldn't read packet header (exit)
Feb 28 08:39:59 pptpd[2209]: CTRL: CTRL read failed
Feb 28 08:39:59 pptpd[2209]: CTRL: Client 183.60.48.25 control connection finished

What that means? I'm located in Lithuania, that's Europe, and that IP address is from... China... Was it a hack try? I wasn't using my connection at that time, no PC left ON at home.

 

[RMerlin]

Hi, I have RT-N66U with Merlin RT-N66U_3.0.0.4_374.40_alpha4 installed. Now I've logged to my router and found this in my log:

Feb 28 08:39:59 pptpd[2209]: CTRL: Client 183.60.48.25 control connection started
Feb 28 08:39:59 pptpd[2209]: CTRL: EOF or bad error reading ctrl packet length.
Feb 28 08:39:59 pptpd[2209]: CTRL: couldn't read packet header (exit)
Feb 28 08:39:59 pptpd[2209]: CTRL: CTRL read failed
Feb 28 08:39:59 pptpd[2209]: CTRL: Client 183.60.48.25 control connection finished

What that means? I'm located in Lithuania, that's Europe, and that IP address is from... China... Was it a hack try? I wasn't using my connection at that time, no PC left ON at home.

Simply someone scanning the Internet, looking for non-secure PPTP VPN access. If you don't use the VPN server, disable it.

 

[cyborgpunte]

have you bought anything from China on internet ??
Same IP is knocking on my door
and I'm located in a different country then you.

...Feb 28 08:39:59 pptpd[2209]: CTRL: Client 183.60.48.25 control connection started
..

 

[brainosas]

Merlin, thank you for explanation.

Simply someone scanning the Internet, looking for non-secure PPTP VPN access. If you don't use the VPN server, disable it.

 

[brainosas]

have you bought anything from China on internet ??
Same IP is knocking on my door
and I'm located in a different country then you.

I did not purchase anything from China. Also wasn't browsing any of their webpages.

 

[DavidEBSmith]

When I had the PPTP VPN enabled I would see scans like that from China, every day at the same time. Punctual hackers they are.

 

[nemesis122]

same here

i had the same ip in my log only one second then he was kicked every night at the same time.
the ip is located in small country in china.
regards
Michael

 

[cyborgpunte]

but why my door ??

I always use proxy's on suspected pages
and mail only to trusted people.

 

[Adamm]

More then likely it was a random botnet going through a list of IPs trying to gain access to anything they can. Very common now days

 

[cyborgpunte]

random ??
Not the "atacker" I think, same IP in three cases above

with a huge list of IP:s then,
because three "random" internet users from 2-3 countries "scanned" from same IP.
With a load of other things in common such as router brand/model,
gmail perhaps, don't know,just wondering, how come.

 

[Adamm]

random ??
Not the "atacker" I think, same IP in three cases above

with a huge list of IP:s then,
because three "random" internet users from 2-3 countries "scanned" from same IP.
With a load of other things in common such as router brand/model,
gmail perhaps, don't know,just wondering, how come.

That's the whole idea of a botnet, find and infect as many computers as possible and add them as zombies. I at times have 100,000 IP's per week trying various things on my connection. For example the past few days my firewall addition has picked up almost 2000 random IP's from various spam countries.

admin@RT-AC68R:/tmp/home/root# ipset -L | wc -l
1837

Nothing really to worry about as long as you have WAN connections to your router disabled.

 

[speedingcheetah]

Last year, That ip and several more Brute Forced my FTP server on my Windows Sever box I have. I noticed the attack when my daily IIS log txt files went from their normal 165k to 73MB in size.

 

[zardox]

Detected the same IP at my n66u
I have VPN activated and web access via Wan.

I´ve just disable VPN. What about Enabling Web Access from WAN ?
should I disable ?

 

[enr00ted]

Detected the same IP at my n66u
I have VPN activated and web access via Wan.

I´ve just disable VPN. What about Enabling Web Access from WAN ?
should I disable ?

If you don't need it, then yes.