Traffic Flow or Unusual Activity?

[Max™]

I just happened to glance in my logs the other day,
in the usual allowed traffic i see 1 IP that seemed to be trying to connect to the only open ports i have, the two rooms i hold,
this single Ip was hitting the same port for my room, over and over, every 5 seconds, filling my log, this happened for 2 days non stop, yet the user never entered the room,

I know we have normal traffic, but as i rarely use winmx, i mostly host/temp host rooms, i thought it was unusual,
then after 2 days, the Ip changed and a new ip from the same range hit the same port every frew seconds, for another 2 days non stop,
now it seems the IP changes every day, still hitting my same port over and over, but is joined by a second ip, sometimes a third joins in,
this fills my logs even larger with them showing up every 5 to 10 seconds, lasting for hours,
i did notice just 1 IP took 20 seconds exactly like a set program looping,

Is any of this normal? or am i being paranoid? your thoughts or ideas are appreciated to resolve or set my mind at rest.
thanks.

[Blitzen]

Sounds like a DOS attack have you traced the ips and got some results, routers usually block such attacks nowadays with spi and nat firewalls enabled.

[Max™]

well i did look them up, 100% of them are from Japan,
i use a cable modem, not a router, so i rely on a software firewall and PG2,
and no i dont use sabre's or bluetac blocklists, its a custom list i created.

[Blitzen]

Are the ips in the wmw blocklist max ? if not iam sure one of the team would look into it i wonder if it is limited to the server you use or effects all, and if it is only you it is effecting or others too

[Blitzen]

Is it in the 202.226.*.*    range max ? as i see some activity within this range on winmx myself but i do not run a room so cannot comment on that area

[Max™]

nope its not that range... yet,
mostly 219.*.*.* & 220.*.*.* ranges

[Blitzen]

Ah ok Max i can only really comment on what i can see during searches on winmx and i dont see any ips within those ranges yet, i hope someone from the blocklist team will be able to assist you.

I know theres a Japanese military range in the 219.166.*.* range maybe big brother is has his eye on you

[Max™]

I think you are right,
i opened my window on PG2 to show 30 'hits' and it took 3 IP's, the same 3 Ip's hitting me over and over just 2 and a half minutes to fill the screen with 30+ hits,
based on 30, thats equal to 1 hit every 5 seconds, to me that's not usual,
later on in the day, 2 of the Ip's had changed to 2 different IP's within the same range,
they did the same as previous and are still bashing me as im posting this.

[GhostShip]

Could you pm me a log of the activity please Max. The fact that an IP may be flagging up in PG is not in itself suspicious but like yourself I would like to get to the bottom of what your seeing.

[Max™]

mostly 219.*.*.* & 220.*.*.* ranges

well looks like the 220. range was a 1-off as it only happened for a few hours, not since,
its just the 219. range now that is relentless,
GS, PM'd as requested, thanks

[Bluey_412]

Japan Internet Initiative?

ghost777?

38.107.164.*  ?

[Max™]

Hi Bluey,
the ones that seem to be hounding me are
Japan Network Information Center
they include the 219 range, such as:
219.36.*.*
219.38.*.*
219.126.*.*
219.128.*.*

[GhostShip]

After looking at the data you have provided and checking the IP's shown in the PG screenshots you sent me it seems that these are just plain ordinary Japanese consumer IP's, one it registered to  SOFTBANK BB CORP and the other to  T-COM.NE.JP. For your future reference the "Japanese Information Centre" is simply the name of the domain names authority for that region of the globe not an ISP company itself, its job is to keep track of all IPs allocated in its region same as ARIN does for the US region.  

http://www.nic.ad.jp/en/

https://www.arin.net/

What else is shown is that they are not trying to connect to you but you to them, I would suggest that these are primary clients and for some reason you are blocking them with a PG blocklist that is obviously open to question, blocking of dynamically allocated consumer IP ranges is why we told folks not to use PG in the first place as innocent folks get allocated such a "blocked"  IP and find themselves in trouble because someone else did something from that IP once in history.

My advice is to remove these consumer ranges  manually from your blocklist and they will never trouble you again.

[Max™]

Ahh,
so its normal then, thanks, just concerned that they appeared so often when other ip's only appear 3 or 4 times in an hour these was like every few seconds and lasted for hours.