Is it hacking?

Antibiotic

Hi, with pfblockerNg, just for experiment I did ban whole Africa and was surprised that my laptop trying to connect some telecommunication services and internet services in Africa. Im from Europe, btw. I did full scan by antivirus nothing was found. Now in doubt, wtf going on. If it was my mobile phone, but this is my laptop. Actually I dont use any illegal software on this laptop or playing the games and have very good antivirus soft, because use this laptop for banking payments. Any ideas?
Screenshot_17-11-2024_222430_192.168.20.1.jpeg
Screenshot_17-11-2024_222351_192.168.20.1.jpeg
Screenshot_17-11-2024_222317_192.168.20.1.jpeg

johnpoz

@Antibiotic take a look at netstat to see what process is doing it.. Could be some addon in your browser as well.

as admin in a cmd prompt run netstat -anb

  TCP    192.168.9.100:18958    208.123.73.77:443      ESTABLISHED
 [firefox.exe]
  TCP    192.168.9.100:20572    34.107.243.93:443      ESTABLISHED
 [firefox.exe]
  TCP    192.168.9.100:21258    146.75.77.91:443       ESTABLISHED
 [firefox.exe]
  TCP    192.168.9.100:21274    178.162.173.120:443    ESTABLISHED
 [firefox.exe]
  TCP    192.168.9.100:21326    151.101.193.188:443    ESTABLISHED
 [firefox.exe]
  TCP    192.168.9.100:21329    146.75.77.188:443      ESTABLISHED
 [firefox.exe]
  TCP    192.168.9.100:21340    23.33.29.88:443        ESTABLISHED
 [firefox.exe]
  TCP    192.168.9.100:21381    142.250.191.164:443    ESTABLISHED
 [firefox.exe]
  TCP    192.168.9.100:21384    104.18.17.97:443       ESTABLISHED

Or you could use tcpview
https://learn.microsoft.com/en-us/sysinternals/downloads/tcpview

btw - I tried talking to that IP on both 443 and 80 and nothing answers anyway.

Antibiotic

@johnpoz said in Is it hacking?:

as admin in a cmd prompt run netstat -anb

I did, but for this moment no connections with those IP's

johnpoz

@Antibiotic I see a 6881 port in there - you running torrents? Also that 6900 port also common torrent port.. So yeah I would expect IPs from all over.. I mean all over!!

Antibiotic

@johnpoz I'm also start think about torrent client))))

johnpoz

@Antibiotic blocking outbound while your running a torrents going to drastically reduce the overall capability for it to function at its peak.

JonathanLee

It looks like bit-torrents, Azure, Limewire, something like that. If you use snort you could activate openAppID and see what it is in a second

Gertjan

@JonathanLee said in Is it hacking?:

If you use snort

Or clean up the PC ?!

johnpoz

Maybe he is running torrents on purpose? He did say it was his laptop.. How would torrent just show up without the user knowing they were running torrents?

Antibiotic

@Gertjan said in Is it hacking?:

Or clean up the PC ?!

Funny)))

Antibiotic

@johnpoz said in Is it hacking?:

Maybe he is running torrents on purpose? He did say it was his laptop.. How would torrent just show up without the user knowing they were running torrents?

It was my torrent client on laptop.

JonathanLee

@Antibiotic get rid of that torrent client eventually it’s gonna break stuff if you keep using it. Trust me. Stop using it, think about how many ports you need open. It just takes one bad download