unauthorized ssh from "218.106.246.174" in china, or am i just paranoid?

Question

noticed unrecognized traffic from ip address "218.106.246.174" using ssh service on my comp. I ran a port scan and their ports 21, 22, 80, and 111 are open. port 111 is a sun server service it appears? However when i went on the internet and entered 218.106.246.174:80 i got a chinese page running on apache installed on their system. Anyways, did they somehow hack on my computer or am i just being paranoid..?

Answer 1

it's not so much their ports that are important as what ports YOU have open. It's possible they might be doing something, so you should probably disconnect the computer from the internet and do as much forensics as you can. Do you use ssh-servers on your own system? If not then that would be a huge red flag if you found one. Otherwise revamp your passwords and keys. Find any logs, this was a quick example i found for ssh http://ubuntuforums.org/archive/index.php/t-13674.html

and http://www.linuxquestions.org/questions/linux-security-4/bad-hackers-438335/



i have a ton of these attempts from all over too, but they fail

Answer 2

ssh allows external users to control your PC.



In general, you should always set your firewall to block this port.



Often the bad guys will scan ip addresses for a response on this port.



Most people leave the administrator account name as administrator and have simple passwords, so it is not difficult to take advantage of this.

Answer 3

a million.) Black Sabbath's Paranoid. 2.) Radiohead's Paranoid Android 3.) garbage's i imagine i'm Paranoid BQ - in all likelihood Black Sabbath's Paranoid. That finished album replaced into groundbreaking.

Answer 4

hi