222.161.2.46 is from China

Firewall Security Log Message:
Somebody is scanning your computer.
Your computer's TCP ports:
3128, 8089, 80, and 6588 have been scanned from 122.227.164.96

Port scanning my IP.

must be.
http://www.globalsecurity.org/military/world/china/changchun.htm

1/19/2009 17:58:31.320
Alert Intrusion Prevention
Possible port scan detected
source: 122.227.164.96, 12200, X1 dest: 206.253.53.110, 8888, X1
TCP scanned port list, 9000, 808, 9415, 8090, 1080

11/18/2009 18:06:40.112
Alert Intrusion Prevention
Possible port scan detected
Source: 122.227.164.96, 12200, X1 Dest: 206.253.53.110, 8086, X1
TCP scanned port list, 8085, 6588, 808, 8090, 8888

Three days now I have been scanned from this IP all blocked. I reversed it and came up with a list of their open ports. Port Scanning host: 122.227.164.96

Open TCP Port: 1 tcpmux
Open TCP Port: 75
Open TCP Port: 80 http
Open TCP Port: 135 epmap
Open TCP Port: 139 netbios-ssn
Open TCP Port: 269
Open TCP Port: 351 matip-type-b
Open TCP Port: 435 mobilip-mn
Open TCP Port: 510 fcp
Open TCP Port: 604 tunnel
Open TCP Port: 679 mrm
Open TCP Port: 767 phonebook
Open TCP Port: 858
Open TCP Port: 940
Open TCP Port: 1025 blackjack
Open TCP Port: 1026 cap
Open TCP Port: 1192 caids-sensor
Open TCP Port: 1271 dabew
Open TCP Port: 1364 ndm-server
Open TCP Port: 1446 ora-lm
Open TCP Port: 1517 vpac
Open TCP Port: 1584 tn-tl-fd2
Open TCP Port: 1662 netview-aix-2
Open TCP Port: 1735 privatechat
Open TCP Port: 1831 myrtle
Open TCP Port: 1930 driveappserver
Open TCP Port: 2007 dectalk
Open TCP Port: 2085 ada-cip
Open TCP Port: 2158
Open TCP Port: 2244 nmsserver
Open TCP Port: 2323 3d-nfsd
Open TCP Port: 2395 lan900_remote
Open TCP Port: 2460 ms-theater
Open TCP Port: 2538 vnwk-prapi
Open TCP Port: 2609 system-monitor
Open TCP Port: 2701 sms-rcinfo
Open TCP Port: 2768 uacs
Open TCP Port: 2841 l3-ranger
Open TCP Port: 2986 stonefalls
Open TCP Port: 3062 ncacn-ip-tcp
Open TCP Port: 3225 fcip-port
Open TCP Port: 3316 aicc-cmi
Open TCP Port: 3389 ms-wbt-server
Open TCP Port: 3522 nssocketport
Open TCP Port: 3596 iw-mmogame
Open TCP Port: 3685 dsx-agent
Open TCP Port: 3837 mkm-discovery
Open TCP Port: 3925 zmp
Open TCP Port: 4010 samsung-unidex
Open TCP Port: 4084
Open TCP Port: 4166
Open TCP Port: 4226
Open TCP Port: 4306

This guy hits my web server a couple a times a day trying to retrieve the same URL \\\"/fastenv\\\" which appears to be some kind of tool used along side proxies. So my guess is he is scanning for proxies. However not sure why he needs to scan the same boxes 5 times a day. I just blocked his IP at my router.

Scans multiple times a day on all ports. My router is set to drop all packets from that IP now, so he doesn't see anything. Send abuse reports to anti_spam@mail.nbptt.zj.cn. If they get enough complaints, maybe they'll do something.

Tries to get into my linux system whenever I am using my USB 3G modem (Rather than my lan connection].

How do you stop this behavior?

Is attempting to gain entry to my system. Firewall (praise be to the designers) is thankfuly keeping them(it) out. Why on earth can the network community be spared this flagrant disregard to one's privacy and enjoyment.

Is attempting to gain entry to my system. Firewall (praise be to the designers) is thankfuly keeping them(it) out. Why on earth can the network community be spared this flagrant disregard to one's privacy and enjoyment.

Is attempting to gain entry to my system. Firewall (praise be to the designers) is thankfuly keeping them(it) out. Why on earth can the network community be spared this flagrant disregard to one's privacy and enjoyment.

Scriptkiddie doing a portscan then trying to connect to every port avail.

These attacks have been going on for days, but only while my computer is turned on. They only last a few seconds but are becoming a real pain. Who can stop this A**HOLE? Leave me alone and get a real life.

These attacks have been going on for days, but only while my computer is turned on. They only last a few seconds but are becoming a real pain. Who can stop this A**HOLE? Leave me alone and get a real life.

My security system is reporting port scans to my home computer which last around ten seconds each occurrence. I am notified while performing various tasks, my work, which causes me to stop work and investigate the attack. Thus, I lose valuable time and resources due to these frequent attacks. This is now causing me to lose money and time. It is horrible to have this happen and I wish it would stop.

My security system is reporting port scans to my home computer which last around ten seconds each occurrence. I am notified while performing various tasks, my work, which causes me to stop work and investigate the attack. Thus, I lose valuable time and resources due to these frequent attacks. This is now causing me to lose money and time. It is horrible to have this happen and I wish it would stop.

OUTPOST FireWall on - Win2000 - SP1
Block activity for application MSTASK.EXE

MSTASK.EXE 122.227.164.96
remote port 12200
Inbound TCP
local port 1025 (LocalHost)

he or she attacks constantly throughout the day

Firewall is stopping these attempted portscans from this IP.

Keeps sending numerous log-in attepmts to access FTP services using an Administrator username.

Tried to hack our ftp server for several hours sending numerous logon attempts on the administrator account.

UDP packet from 222.161.2.46:54856 to :1027

tries to get in my computer at least 15 times an hour.

Description Packet sent from 222.161.2.46 (UDP Port 55901) to 98.193.135.183 UDP Port 1027) was blocked
Rating Medium
Date / Time 2008/02/29 17:52:30-6:00 GMT
Type Firewall
Protocol UDP
Program
Source IP 222.161.2.46:55901
Destination IP 98.193.135.183:1027
Direction Incoming
Action Taken Blocked
Count 1
Source DNS