Random incoming connections detected?

[KingRoan]

Hi,

it was an inbound connection again on port 445 with a strange IP Adress. ( Even tho i blocked the Port in the Firewall itself?)

In that time i was using opera again, not firefox like before.

No link or App involved.

The export is in the attachments.

What I also did is, I picked out all the IP addresses that tried to connect to me and did a reverse IP check. So I found out where they are hosted.
I wrote a complaint to the corresponding places, and even received one answer so far:

Quote

We've received your ticket and it's forwarded to the Abuse department for further processing, we'll contact our client and request appropriate measures to be taken on their side, please allow at least 24 hours for the message to be received and processed.

In the meantime feel free to update us, should you find yourself under attack from any other of our servers.

I am curious what will result from it.

 

I also made all the Updates you mentioned above.

And if nothing else can be done, so be it. I'll just have to live with the thought that apparently someone wants very urgently on my PC😁

Block-yesterday.txt

[Maurice Naggar]

That was a INBOUND event.  As previously noted, your machine is being protected by the Malwarebytes Premium.  There is not much more that can be done.

Perhaps investigate adding a hardware router device between the incoming internet-device and your machines.  That is if you do not currently have a hardware router.

Perhaps adding a hardware network switch behind the router.  That could help to futher obfuscate your hardware.

The Block notices from Malwarebytes web protection do mean that Malwarebytes Premium is keeping your pc safe from potential harm. 

A block notice is an advisory of the "block".   Notices can be turned off ( if you desire) if they are too much of a distraction.

 

The Malwarebytes web protection, by default, will always show each  block occurrence. 

The Malwarebytes Webs protection feature will advise customers when a known or suspected malicious IP is attempted to be reached (outgoing) or is trying access your PC.    In these cases here, they were Inbound.

  

See our info page https://www.malwarebytes.com/lp/ip-blocking/?ipblock=true 

  

Incoming block notice can be ignored, the Malwarebytes Premium real-time protection is blocking the threat and there is nothing more that can be done. 

On Outbound blocks, any attempted connection was stopped. 

.

If you are inclined, you may consider adding the blocked IP's  into the Block list of the firewall.

I cited a how-to-link in my reply  https://forums.malwarebytes.com/topic/261882-inbound-connection-to-svchostexe/?do=findComment&comment=1395349

 

Edited December 28, 2021 by Maurice Naggar

[Maurice Naggar]

Good morning. I hope you are doing well. Are you needing other help?

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks