Sub-Seven? Korea? July 27?

[Airhead]

Did I miss something in the news? Was there some kind of major hacker attack coming from Korea on July 27 or something?

Repeated alerts to my Zone Alarm while I was working at the computer this morning sent me checking my Zone Alarm logs, which I hadn't done in weeks. Since I'm not that knowledgeable about what the logs all mean, I use Zone Log Analyzer, which color codes various types of alerts to help me understand some of it. (Yes, I've tried reading about it, but this old brain has a hard time comprehending a lot of what I read.) As it turned out, this morning's alerts were all coded "harmless." (Nonetheless, I may want to look into this later.) But looking back over the past few weeks logs, I was startled to see the logs for July 27.

Since I've been on cable with my current ISP, I normally get maybe eight to twelve alerts a day, and rarely is even one of those coded as a possible attempt to attach to a trojan server. But on July 27, there were 45 alerts, 37 of which were to port 27374, a known trojan port. I didn't look up all of these entries, but I did check 20 of them, of which 15 originated in Korea. One additional originated in China. The interesting thing is that only two of these were from the same IP address.

The next day all this stopped just as suddenly as it started. I was back to only nine alerts with zero coded for possible trojans. In fact, I haven't had any coded for possible trojans since.

Can anyone shed any light on this for me? I'm attaching the log for July 27 in the event anyone thinks you might spot something helpful to understanding this. (I substituted xxx's for part of my own address.)

[matthewnowell]

They are after you!!!

[gabriel_c]

maybe some script kidiot was scanning a range of ip addresses for known Trojan ports trying to find someone infected, and you were in that range and got scaned several times. You shouldn't worry about that.

[preep]

sounds like they`ve put it though a proxy, that would explain the same Ip`s

Preep

[Airhead]

Duh! A proxy, of course. Why didn't I think of that. I imagine that is what most hackers do to avoid being caught. Shows you how much I know about all this.

I really was baffled by all the different addresses, thinking it must be that many different individuals. I did look up more of the addresses, most of which also seemed to be from Korea.

Yes, I am paranoid. But not so paranoid as to believe that the Koreans are now trying to steal the original quilting patterns off my machine. (They wouldn't find much else of interest.) I didn't think it was likely that I was being singled out, but was sure curious why there should be such a flurry of activity on a given day. If it was all just a few individuals, though, it probably isn't all that out of the ordinary.

[preacherman481]

Originally posted here by Airhead
Duh! A proxy, of course. Why didn't I think of that. I imagine that is what most hackers do to avoid being caught. Shows you how much I know about all this.

I really was baffled by all the different addresses, thinking it must be that many different individuals. I did look up more of the addresses, most of which also seemed to be from Korea.

Yes, I am paranoid. But not so paranoid as to believe that the Koreans are now trying to steal the original quilting patterns off my machine. (They wouldn't find much else of interest.) I didn't think it was likely that I was being singled out, but was sure curious why there should be such a flurry of activity on a given day. If it was all just a few individuals, though, it probably isn't all that out of the ordinary.

Oh, I don't know Airhead. Maybe it's a case of industrial espionage. Good quilting patterns are hard to get.