Rare UPnP logs in Zyxell modem/router

[Sikkek]

Ik bekeek zojuist even de logs van mijn Zyxel modem (2602H-61C) en zag de volgende regels die ik niet kan plaatsen:

code:

# Time  Message  Source  Destination  Notes  
1  06/10/2011 08:41:45   148.13.117.252:2080 148.82.139.116:38081 UPnP 
2  06/10/2011 08:27:00   148.13.117.252:2080 148.82.139.116:38081 UPnP 
3  06/10/2011 08:26:59   148.13.117.252:2080 148.82.139.116:38081 UPnP 
4  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
5  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
6  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
7  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
8  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
9  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
10  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
11  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
12  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
13  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
14  06/10/2011 08:26:15   148.13.117.252:2080 148.82.139.116:38081 UPnP 
15  06/10/2011 08:25:57   148.13.117.252:2080 148.82.139.116:38081 UPnP 
16  06/10/2011 08:25:56   148.13.117.252:2080 148.82.139.116:38081 UPnP 
17  06/10/2011 08:25:55   148.13.117.252:2080 148.82.139.116:38081 UPnP 
18  06/10/2011 08:25:55   148.13.117.252:2080 148.82.139.116:38081 UPnP 
19  06/10/2011 08:25:55   148.13.117.252:2080 148.82.139.116:38081 UPnP 
20  06/10/2011 08:25:55   148.13.117.252:2080 148.82.139.116:38081 UPnP 
21  06/10/2011 08:25:55   148.13.117.252:2080 148.82.139.116:38081 UPnP 
22  06/10/2011 08:25:55   148.13.117.252:2080 148.82.139.116:38081 UPnP 
23  06/10/2011 08:25:55   148.13.117.252:2080 148.82.139.116:38081 UPnP

Volgens ip-address-lookup-v4.com is 148.13.117.252 een ip adres van DoD Network Information Center? 148.82.139.116 lijkt bij een eindgebruiker in Noorwegen uit te komen (148-82-139-116.ip.akershus-f.kommune.no)

Moet ik me zorgen maken? Probeert iemand mijn modem via UPnP te hacken? (Ik heb UPnP aanstaan voor Windows Home Server 2011)

[brederodekater]

Ik zou even een virusscanner erover heen halen. Dit is wat ik kon vinden over TCP poort 2080:

PORT 2080 – Information
■Port Number: 2080
■TCP / UDP: TCP
■Delivery: Yes
■Protocol / Name: [Malware known as WinHole]
■Port Description: [malware info: WinHole]
■Virus / Trojan: Yes, Caution!

Bron: http://www.auditmypc.com/tcp-port-2080.asp

En hier nog wat meer informatie: http://www.speedguide.net/port.php?port=2080

[ Voor 9% gewijzigd door brederodekater op 13-06-2011 18:00 ]