What are these ip adresses my computer is connected and how do I block them if they are malicious? [closed]

Question

When I execute a netstat command i see several ip-adresses that have connection to my pc and I don't what they are for. These are the ip's.

 TCP    192.168.1.20:1042      fa-in-f125:5222        HERGESTELLT
 TCP    192.168.1.20:1238      we-in-f100:http        HERGESTELLT
 TCP    192.168.1.20:1281      bru01m01-in-f82:http   HERGESTELLT
 TCP    192.168.1.20:1282      bru01m01-in-f82:http   HERGESTELLT
 TCP    192.168.1.20:1283      bru01m01-in-f82:http   HERGESTELLT
 TCP    192.168.1.20:1284      bru01m01-in-f82:http   HERGESTELLT
 TCP    192.168.1.20:1285      bru01m01-in-f82:http   HERGESTELLT
 TCP    192.168.1.20:1289      bru01m01-in-f138:https  HERGESTELLT
 TCP    192.168.1.20:1294      bru01m01-in-f101:http  HERGESTELLT
 TCP    192.168.1.20:1295      bru01m01-in-f138:http  HERGESTELLT
 TCP    192.168.1.20:1296      bru01m01-in-f101:http  HERGESTELLT
 TCP    192.168.1.20:1297      ww-in-f132:http        HERGESTELLT    
 TCP    192.168.1.20:1298      bru01m01-in-f191:http  HERGESTELLT    
 TCP    192.168.1.20:1299      bru01m01-in-f191:http  HERGESTELLT    
 TCP    192.168.1.20:1300      bru01m01-in-f191:http  HERGESTELLT    
 TCP    192.168.1.20:1301      bru01m01-in-f191:http  HERGESTELLT    
 TCP    192.168.1.20:1302      bru01m01-in-f191:http  HERGESTELLT    
 TCP    192.168.1.20:1303      fra07s07-in-f113:http  HERGESTELLT    
 TCP    192.168.1.20:1304      bru01m01-in-f191:http  HERGESTELLT
 TCP    192.168.1.20:1310      mil01s16-in-f18:http   HERGESTELLT   
 TCP    192.168.1.20:1316      mil01s16-in-f18:http   HERGESTELLT    
 TCP    192.168.1.20:1318      193.247.193.85:https   HERGESTELLT    
 TCP    192.168.1.20:1334      server-216-137-61-177:http  HERGEST    
 TCP    192.168.1.20:1381      46.105.131.100:http    HERGESTELLT    
 TCP    192.168.1.20:1410      87.252.216.36:https    HERGESTELLT    
 TCP    192.168.1.20:1412      87.252.210.40:http     HERGESTELLT    
 TCP    192.168.1.20:1425      mil01s16-in-f18:http   HERGESTELLT

How do I find out if they are malicious, for example a connection opened by a troyaner. And how do I block them?

Answer 1

Understanding netstat and getting useful information

HERGESTELLT means that there is a connection. Ports that have been opened by server programs on your computer are in state LISTENING (ABHÖREN) instead. Looking at the target ports, this is likely web traffic with the exception of the first one.

In order to get more useful output, you need to use some parameters for netstat as explained in the documentation:

netstat -a -n -o

• -a will include ports in state LISTENING,
• -n will show the real ip-addresses instead of the DNS reverse lookup.
• -o win include the process id (use the Windows Task manager to look it up).

Please keep in mind that in case your computer got infected, you cannot trust the output of netstat as the malicious program might have manipulated it.

Owners of ip-addresses

For the cases in which the IP-address is visible in your log, the owners are as follows:

• 193.247.193.85: Google
• 46.105.131.100: Astro Empires is a Massively Multiplayer Online Game
• 87.252.216.36: Gambling related online games
• 87.252.210.40: Casino Website

All of them seem to be normal websites, likely not related to trojans.

Answer 2

Let's look at a line:

TCP 192.168.1.20:1381 46.105.131.100:http HERGESTELLT

I don't speak German, but google search; and matching with my netstat output I believe HERGESTELLT means ESTABLISHED. This means that your local IP (192.168.1.20) on port 1381 has established a TCP connection with (46.105.131.100) via the port typically used for http (port 80). Running a whois on the address gives:

### whois 46.105.131.100        
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '46.105.131.96 - 46.105.131.111'

inetnum:         46.105.131.96 - 46.105.131.111
netname:         Cybertopia
descr:           Astro Empires website
country:         PT
org:             ORG-OL44-RIPE
admin-c:         OTC6-RIPE
tech-c:          OTC6-RIPE
status:          ASSIGNED PA
mnt-by:          OVH-MNT
source:          RIPE # Filtered
[...]

which leads to a website that you (or another user) may legitimately be establishing a connection with. Or they may not.

Note, every time you visit a website you need to establish a connection with it, so you should have benign entries like:

tcp        0      0 192.168.1.120:51127 stackoverflow.com:http   ESTABLISHED

Now you may note several entries like bru01m01-in-f82:http. These are pretty useless as is, since you only have an incomplete part of the host name (bru01m01-in-f82). What you really want to do is run netstat -n (do not resolve names) or netstat --wide (do not truncate resolved host names), so a hostname of iad04s01-in-f83.1e100.net (run by google) is not truncated into a meaningless iad04s01-in-f18.1. (These command line options may vary slightly depending on your particular version of netstat; I gave options of the linux version of netstat that comes with net-tools. The windows netstat command is likely slightly different.)