Tech Support Guy banner

Arizona WAN showing Irish AWS IP in DDWrt startup logs

457 Views 1 Reply 1 Participant Last post by  AlwaysBrian
Hello,

I have one last curiosity here that I can't seem to find any explanation to. If you've read any of my other questions then you would know that I was dealing with serious network issues at the time of this screenshot. I have a limited, at best, understanding of networking but I can say with confidence that the WAN was set to automatic DHCP and, until this day, had always gotten an IP in the Phoenix suburbs area where we lived. Many times the WAN IP would change and it never showed anything that wasn't a Cox Communications IP. This anomaly lasted only a few minutes until the network shut back down on me. When it came back up? Cox IP, based in the Phoenix area. If you've seen my other posts then maybe this is related to a denial of service? If you haven't seen my other posts, no worries, I couldn't get an answer from Cox (they had a different modem on file for us at one point, and they were reluctant to divulge the serial number to me, but this was weeks after).

SO, is this malicious? A sign of some telecommunications equipment wiz/stalker? Or is this normal...? Bear in mind I have no idea about the other entries, that is to say they are not the result of any changes I made in DD WRT...I wouldn't know how.

Font Screenshot Terrestrial plant Number Document

Attachments

See less See more
2
Status
Not open for further replies.
1 - 2 of 2 Posts
and here's something I just found. It's a grab of incoming dropped connections from the DDWrt logs...It's from 1-19-2018, I'm trying find the date of the above shot. But here you see the same exact address attempting to come IN...

Rectangle Font Screenshot Parallel Number


edit: I've found the dates and times. The first screenshot is 1/20/2018 at 7:26pm. The second, where it's incoming is 1/19/2018 around 12:30pm (times are in top right of shots). This means that over 24 hours before becoming my WAN IP, according to DDWRT Syslog, the same IP was making multiple attempts (I've omitted at least 5 more screenshots from different times on the 19th) on the INCOMING side. Since this is not associated with any website, and according to current tracert/traceroute is not even up and running anymore, what does this show? Should I send this info to Amazon? Will they tell me who, what, where, when and how?

Attachments

See less See more
2
1 - 2 of 2 Posts
Status
Not open for further replies.
Top