1

I noticed that my firewall yesterday blocked outgoing attempts starting at port 61494 and worked its way up to 62381, making a TCP outgoing attempt at each port once. The remote IP address seems random, and changed up every 1-20 times. The remote port is always port80. Here is a small snippet below.

Is this a trojan? How do I begin to troubleshoot this to figure out whats going?

enter image description here

1 Answer 1

2

It could be malware, or it could be an attempted Torrent connection or something else. The first few IP addresses resolve to cdn1.static.pornhub.phncdn.com.swiftcdn1.com.

You can find out what program is sending these requests with Glasswire for Windows or BitMeter OS for linux, mac and Windows.

1
  • glasswire, never heard of it, what a fantastic little app. Still can't figure this out, I had another wave of outgoing TCP packets 1 port at a time going up in the 60000 range again tonight.This time port 443 was involved.The sites I saw them resolve to vary from what you said to apple, google, dropbox, etc??
    – wardr
    Feb 29, 2016 at 5:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .