Protection Log: (what does the number after the IP address mean)?

[Eagleeye]

Good morning everyone,

 

     (Referring to the attached screenshot of my MBAM Protection Log)

 

On May 31st, there were multiple inbound blocks made by MBAM for traffic originating from IP address:  121.10.130.9.  (As noted...all the blocks occurred in rapid succession).  I'm reasonably certain I was offline at the time these blocks occurred, as I always turn off my monitor when not using the computer...and hence, would not have seen any popup generated by MBAM.

 

In the Protection Log screenshot, I've placed a red arrow above the number "0", which appears right after the IP address.

 

My question:  What does the "0" refer to?

 

(I also performed quick scans with MBAM, Outpost, & SAS).  No issues were found.

Going back in the Protection Logs 10 days does not show any blocks, and no further blocks have been seen since this occurrence on May 31st.

 

Thank you for your time and any enlightenment!  (Apologies for the unusually large size of the screenshot.  My "expertise" with using MS Paint leaves something to be desired).

 

EE 

 

[DougCuk]

Normally the trailing extra digit would indicate the port number the connection was attempting to access.

Checking my own logs all the trailing digits are - like yours - all shown as zero.

I suspect MBAM is not logging the real port number and is just displaying zero as a default

 

Port 0 doesn't actually exist - See here  https://www.grc.com/port_0.htm

[DougCuk]

The blocked IP is listed as a malicious web-address by MBAM and is located in the city of Guangdong in China

See here http://db-ip.com/121.10.130.9 - the IP address is register to the Guangdong Network of ChinaTelecom

[Eagleeye]

Much obliged for the info, DougCuk!

 

Cheers!

 

EE