Why is the russian embassy trying to connect with my connection ?

Okay so I booted up Peerblock and the Firefox as usual, when Peerblock starts flashing like mad. It was blocking a connection from;

EMBASSY OF THE RUSSIAN FEDERATION IN JAPAN

The source was listed as 192.168.0.101 8798, and was trying to connect at least three times per second. Any ideas ?

I don't have any idea, but sounds pretty crazy.

second line

perhaps this might help

Link

reply to post by Red_xi


192.168.0.101 is either the ipaddress of your router, some other network device, or computer, on your local network. Could it possibly be your neighbor, brother/sister, your boss, or a colleague? I'm guessing that the Russian embassy part is spoofed. Like adding a wrong label to a jar. Someone wanted you to believe that it was the Russian embassy. They'd not have an ip address starting with 192.168.x.x. My 2 cents...

My bad, the source was 221.112.109.250. According to www.ip-adress.com it belongs to U's Communications Corp in Japan. Quick search only revealed this page

reply to post by Red_xi


Yup! That ip seems to belong to a range of ips tagged with the description "EMBASSY OF THE RUSSIAN FEDERATION IN JAPAN". Location: Tokyo, Japan.

When you posted the wrong IP address you also posted a port, 8798.

What was the information for this IP address?

If you use Windows you can download and use TCPView, it will show all open connections, IP addresses and which program is using that connection.

reply to post by Red_xi


I get all sorts of bizarre places like that sniffing around my ports. Just browsing through today's list, I got:


*Office of the President of the Republic of Lithuania

*State of South Carolina

*AFNCA Inc

*Democritus University of Thrace

*California Institute of Technology

*University of Hawaii

*eNom Incorporated

*StarHub Cable Vision Ltd.

*DONGGUK University

*Emirates Telecommunications Corporation

*Sharif University of Technology

*St. Joseph's College

And I have seen places like the DoD and Eli Lilly Corporation, etc. The weirdest one was some missile defense contractor.

Going to all the myriad places on the internet attracts the attention of all kinds of "interesting" organizations. The important part is PeerBlock caught it, and blocked it. They didn't get whatever they were looking for.


TheAssoc.

reply to post by TheAssociate


Could it be that PeerBlock is giving the wrong information?

Do you have any P2P program active?

reply to post by ArMaP


Yeah I was running a p2p programme. I was seeding the wikileaks insurance file and also the BP oil leaks videos :-s

I'm sure it's jsut something of nothing

reply to post by Red_xi


That's a good reason to have accesses from all over the world, embassies included.

reply to post by ArMaP


Nah, it gives the IP of all the attempted connections and I check it now and then for accuracy. I think some are due to spoofing, but most turn out to be the place it reports it to be.

Example:

Office of the President of the Republic of Lithuania : 195.182.71.227

195.182.71.227 - Geo Information

IP Address 195.182.71.227

Host 195.182.71.227

Location LT LT, Lithuania

City Vilnius, 65 -

Organization Infostruktura customers, Vilnius region

ISP State Enterprise Infostruktura

AS Number AS6769 State Enterprise Infostruktura

Latitude 54°68'33" North

Longitude 25°31'67" East

Distance 1342.18 km (833.99 miles)

whois

It's a Lithuanian IP, though I have no idea whether it's the Office of the President.

Some of the most bizarre ones turn out to be the organization reported.

And no, I don't do P2P. My bandwidth is limited due to AT&T sucking profoundly. I'm just paranoid and like to see who's trying to connect to me.




TheAssoc.

[edit on 20-8-2010 by TheAssociate]

reply to post by TheAssociate


What I was asking is how do you know the IP addresses given by PeerBlock are correct, do you use any other program to check for connections to your computer?

reply to post by ArMaP


I had a lot of the same IP's get flagged by PeerGuardian before I switched to PeerBlock, so I assume everything is working correctly. Besides PeerGuardian, there really isn't any other program to confirm the findings with, as far as I know.


TheAssoc.

Agreed with ArMaP. If you had a P2P running you are going to get a lot of things because they are trying to connect. My suggestion is to drop the P2P.

P2P are bad news, sooner or later you are going to get bad