[CRTech] Christian Radio Tech [MSG 79168]
[Thread Prev] [-- Thread Index --] [Thread Next] [Date Prev] [-- Date Index --] [Date Next]
Re: hacking continued
To: CRTech <crtech@crtech.org>
Subject: Re: hacking continued
From: Matthew Chambers <mchambers@showmeham.info>
Date: Tue, 14 Mar 2017 10:45:00 -0500
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=showmeham-info.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=+YJ64C+Gb/BV1bUPa/xnaY8HI5Vwi288qUzDaA51BEo=; b=NwpXRQgu32Ds+823nII2TC/SuDHzbTRk6vwq34bG+akWnUeoNaRcpo5egSDlJM8GtS eqVS1EFyEturFXeVCFB0nC8F9KtIUB0eHFrupeVbJSKZi58pnamxOFyq5L4qMp0OZObY sSen6Guxr7HHFgtm2R30ETuVlomUMSLf4WHMFT3kfnRMvZBS4w5x0oQ3OAE3rhTe92O7 f02dkogYb8McW4RYRjhnFxa77A8bgvXGhLxS+taP18ylFJ78IfBx247tM3AN1fadgbz1 DE6WLZ6sMJVJzW3xJyt1mEAhZszMZaBsCJGvBMeXlDvVAMXtopsKz+C0Fv/U8XCZbcOG TfsA==
In-reply-to: <812f36bb-e2cc-bf85-ba40-df7d81d2e32b@knlr.com>
References: <812f36bb-e2cc-bf85-ba40-df7d81d2e32b@knlr.com>
I'd be wondering if there is any pattern to where those IP addresses belong to?

Matthew A. Chambers, NR0Q



On Tue, Mar 14, 2017 at 10:43 AM, Terry Cowan <tcowan@knlr.com> wrote:

Several weeks ago we found "tone" on some of our programs.  Apparently our AMBOS receiver was hacked and the tone generator turned on.  True the receiver was port forwarded without protection.  So I created a program and redirected that port to it to see if we were being hacked.  Here is the log of the "hacking". 

Terry Cowan

KNLR/KNLX

03/04/17 22:27:14 89.248.167.131
03/05/17 14:40:31 177.140.27.47
03/05/17 14:40:31 177.140.27.47
03/10/17 08:52:24 94.102.49.190
03/13/17 08:11:57 189.34.242.231
03/13/17 08:11:58 189.34.242.231
03/14/17 04:07:58 86.110.119.19




Follow-Ups: Re: hacking continued
(Shane Toven <shanetoven@gmail.com>, 14 Mar 2017 15:47:05 -0000)
Re: hacking continued
(Terry Cowan <tcowan@knlr.com>, 14 Mar 2017 16:11:58 -0000)
RE: hacking continued
(Mike Shane <mshane@salemomaha.com>, 14 Mar 2017 23:42:25 -0000)
References: hacking continued
(Terry Cowan <tcowan@knlr.com>, 14 Mar 2017 15:43:11 -0000)
Prev by date: hacking continued
(Terry Cowan, 14 Mar 2017 15:43:11 -0000)
Next by date: Re: hacking continued
(Shane Toven, 14 Mar 2017 15:47:05 -0000)
Prev by thread: hacking continued
(Terry Cowan, 14 Mar 2017 15:43:11 -0000)
Next by thread: Re: hacking continued
(Shane Toven, 14 Mar 2017 15:47:05 -0000)
CRTech.org