Wrong user or IP in High Sierra terminal

Question

When reinstalling MacOS High Sierra, setting root user password I have noticed strange line dsl-201-101-1-179-sta: before my admin username user$.

I Googled and found references to WannaCry ransomware, for instance this. Other references showed IP with Mexican DSL provider dsl-201-100-226-146-sta.prod-empresarial.com.mx.

I am really not sure how it came to be but it does not matter how many times I reinstall my Mac. After a while this comes up in my terminal. I have never used Windows on this computer and it was wiped securely through disk utility before fresh install many times.

Last login: Sat Mar 10 13:13:20 on ttys000
dsl-201-101-1-179-sta:~ user$ lsof -i | grep LISTEN

rapportd   258 user    3u  IPv4 0x6ee1327a4ca5e447      0t0  TCP *:49169 (LISTEN)

rapportd   258 user    4u  IPv6 0x6ee1327a4cb40e3f      0t0  TCP *:49169 (LISTEN)

Answer 1

Short answer: this is not an indication of a problem, just a side effect of the somewhat haphazard way things try to figure out your computer's "name".

Long answer: The standard command prompt includes the computer's hostname, the directory you're in, and your username. The problem here is how the "hostname" is determined. You probably have a computer name set in System Preferences -> Sharing, right? Well, it'll sometimes use that... but before "trusting" that it tries a reverse DNS lookup on your primary IP address, and if it gets back a name from the DNS server, it treats that as more authoritative than what you put in Sharing prefs. But often the DNS server doesn't really have a name to go with your IP address so it makes something up, or takes a guess, or something like that, and you wind up with something weird in your prompt.

In this case, I'm guessing your Mac's primary IP address is 201.100.226.146, right? A reverse DNS lookup on that gives the full DNS name dsl-201-100-226-146-sta.prod-empresarial.com.mx, so your Mac takes the hostname portion -- the bit before the first "." -- and uses that as your hostname. Resetting your Mac won't have any effect on it, because it's coming from your Internet connection. But if you switch Internet connections -- say, by going to the local coffee shop and using their Internet -- you'll get a different name (or no DNS name, in which case it'll use what you put in the Sharing prefs).

If it really bugs you, you can override it with sudo scutil --set HostName "hostnameyoudratheruse", but I wouldn't bother; just ignore it.

As for the info you're getting from lsof, it's a bit unclear what rapportd does, but it seems to be a standard Apple process, not anything suspicious. See "What is rapportd and why does it want incoming network connections?" on Ask Different.