Wednesday, September 8, 2021

WiFi router logs weird intrusions when Wavlink extender is connected

I'm trying to get a Wavlink wifi extender working. When I power it up wirelessly my router logs a ton of intrusion attempts. Examples:

Intrusion -> IN=ppp0.1 OUT= SRC=205.185.118.222 DST=97.126.23.107 PROTO=TCP SPT=55062 DPT=22 Intrusion -> IN=ppp0.1 OUT= SRC=104.140.188.30 DST=97.126.23.107 PROTO=TCP SPT=62924 DPT=9000 

Notice that the DST is always 97.126.23.107. The SRC IP is all over the place and seems random. If I try to connect to 97.126.23.107 with a web browser nothing comes up. I suspect this IP might be a hard-coded Wavlink thing, but I don't understand what this activity is about and why the router thinks these are intrusions. Basically I'm just wondering what's going on.

Can anybody give me any clues?



No comments:

Post a Comment