Check Website
Inclusion Status
It is currently Sat Nov 17, 2018 11:20 pm

All times are UTC




Post new topic Reply to topic  [ 9 posts ] 
Author Message
 Post subject: Inquiry regarding port scanning originating from Mozilla?
PostPosted: Sun Feb 08, 2015 2:43 pm 
Offline
User avatar

Joined: Mon Feb 13, 2012 12:09 pm
Posts: 45
Location: Mid-Atlantic region (USA)
Good morning everyone,

My apologies if this is in the wrong sub-forum.

Description of issue:

While viewing the Mozilla Forums earlier this morning, my Outpost Firewall's Attack Detection blocked two separate multiple-port scanning attempts originating from the IP address shown in the Attack Detection Log excerpt below.

8:43:34 AM 140.211.166.65 Intruder unblocked
8:31:34 AM 140.211.166.65 Subnet blocked for 12 min SCAN (50746, 50743, 50745, 50747, 50744, 50752, 50751)
8:19:22 AM 140.211.166.65 Intruder unblocked
8:07:22 AM 140.211.166.65 Subnet blocked for 12 min SCAN (50508, 50509, 50514, 50515, 50513, 50519, 50520)

In checking the IP address here, the IP PTR resolves to master.mozillazine.org.

My question: Why would Mozilla be engaging in this suspicious activity?

After leaving the Mozilla Forums to go offline and review the alerts received on the port scanning activity, I attempted to go to the Mozilla website again, with the intention of posting an inquiry about this incident there. Unfortunately, Firefox (after some delay), generated a message that it was unable to connect (with the usual list of possible reasons included).

Thank you for your time and any enlightenment.

_________________
Pete C.



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Inquiry regarding port scanning originating from Mozilla
PostPosted: Mon Feb 09, 2015 7:39 pm 
Offline
Site Admin

Joined: Thu May 28, 2009 10:25 am
Posts: 6016
I'll have to dig into this (there's no reason for their doing this)

_________________
Regards
Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

Keeping it FREE!



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Inquiry regarding port scanning originating from Mozilla
PostPosted: Mon Feb 09, 2015 7:56 pm 
Offline
User avatar

Joined: Mon Feb 13, 2012 12:09 pm
Posts: 45
Location: Mid-Atlantic region (USA)
Thanks very much for any help, Steven! :)

_________________
Pete C.



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Inquiry regarding port scanning originating from Mozilla
PostPosted: Sat Mar 07, 2015 10:13 pm 
Offline
User avatar

Joined: Mon Feb 13, 2012 12:09 pm
Posts: 45
Location: Mid-Atlantic region (USA)
[FOLLOW-UP NOTE]:

Once again just now (while viewing the Mozilla Firefox Forums), my Outpost Attack Detection Log recorded yet another port scanning attempt from the same IP reported in my OP above (which was once again blocked, by the way). Just WHAT is going on with Mozilla? This is becoming increasingly suspicious.

Regards,

_________________
Pete C.



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Inquiry regarding port scanning originating from Mozilla
PostPosted: Sun Mar 08, 2015 10:12 am 
Offline
Site Admin

Joined: Thu May 28, 2009 10:25 am
Posts: 6016
Sorry for the delay.

I'm having a little difficulty replicating this so far annoyingly.

I'm going to be out for most of today (spending the day with my son), but will continue with this when I get back.

_________________
Regards
Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

Keeping it FREE!



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Inquiry regarding port scanning originating from Mozilla
PostPosted: Thu May 28, 2015 9:22 am 
Offline
User avatar

Joined: Mon Feb 13, 2012 12:09 pm
Posts: 45
Location: Mid-Atlantic region (USA)
Greetings again,

Just another update that the port scanning attempts described in my OP coming from Mozilla are continuing to be blocked by Outpost any time I even visit the forums (regardless of whether or not I can even get lucky enough to log-in). It will occur even if I do nothing more than a Google search for the Mozilla Forums and then click on the first or 2nd result shown.

This morning around 4:50 a.m. (U.S. EST), I also made repeated attempts just trying to get to the Mozilla Forums. Firefox would wait and wait, then finally display a message the server was taking too long to respond. Yet, when I checked "forums.mozillazine.org" at the Isitdownrightnow.com website...it reports a response time of 83 ms, but says the server is up and reachable.

This will be my last post about this continuing suspicious activity on Mozilla's part. I won't waste anyone's time further, since apparently whatever is occurring isn't happening to anyone else but me. I'll just try to get any needed Firefox help from some other website.

Regards,

_________________
Pete C.



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Inquiry regarding port scanning originating from Mozilla
PostPosted: Thu May 28, 2015 1:52 pm 
Offline
Site Admin

Joined: Thu May 28, 2009 10:25 am
Posts: 6016
Pete,
Cheers for the update.

Am still trying to replicate it :(

_________________
Regards
Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

Keeping it FREE!



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Inquiry regarding port scanning originating from Mozilla
PostPosted: Tue Aug 04, 2015 2:19 am 
Offline
User avatar

Joined: Mon Feb 13, 2012 12:09 pm
Posts: 45
Location: Mid-Atlantic region (USA)
A little 'tidbit' of additional info...
(Yeah,...I know...I'd indicated my last post would BE the last one, however I noticed a change - as explained below & figured it might be worth mentioning).

I began viewing topics/posts at the Mozilla/Firefox Forums this evening (around 7:38 p.m. U.S. EST). At 7:39 p.m., the IP address shown in my first post made yet another port scanning attempt which was blocked by Outpost. (On this visit, I did not log-in - just viewed the Board as a guest).

Change noticed: The number of ports being scanned has now increased from 7 to 10. The ports on which the scan attempts were made are all in the 50,000 range - same as previous attempts.
Also, after Outpost blocked this latest port scanning attempt, I found I could no longer view any topics/posts, log-in, etc. (i.e., clicking a topic title on the Board's Index page or on "login" did absolutely nothing).

Whoever is behind this suspicious activity is apparently intent on escalating their intrusive behavior.

*NOTE: Shortly after my last post, I sent an email inquiry to the person shown in the excerpt below from the IP lookup results generated here:

RTechHandle: DC80-ARIN
RTechName: Crowe, David
RTechPhone: +1-541-346-1698
RTechEmail: crowed@nero.net

Not surprisingly, this David Crowe didn't even have the decency/courtesy to respond to my request for an explanation. :P

So, the questions still remain......to what end and why, is Mozilla/Firefox continuing this intrusive activity?

[P.S - This WILL be my last update on this issue, unless something happens to be discovered on hp Hosts' end to explain Mozilla's conduct].

Regards,

_________________
Pete C.



IP:
top
Top
 Profile  
Reply with quote  
 Post subject: Re: Inquiry regarding port scanning originating from Mozilla
PostPosted: Tue Aug 04, 2015 3:30 pm 
Offline
Site Admin

Joined: Thu May 28, 2009 10:25 am
Posts: 6016
Cheers for the update :)

_________________
Regards
Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

Keeping it FREE!



IP:
top
Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
hpHosts and hpHosts Online are copyright © Malwarebytes Corp - All Rights Reserved

Powered by phpBB © 2000-2009 phpBB Group