I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this:
j0h@server:~$ w 22:06:02 up 18 days, 7:02, 3 users, load average: 0.71, 0.35, 0.17 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT j0h tty5 07Jun14 14days 0.38s 0.33s -bash j0h pts/0 :0.0 Fri21 24:08m 0.20s 0.20s /bin/bash j0h pts/2 22.214.171.124.kn 22:01 2.00s 0.22s 0.00s w
so then, I saw the 126.96.36.199.kn address and I am wondering, what is that address? That isnt my usual IP. so then, I checked my IP address, and indeed, they do not match. I decided to browse the IP 188.8.131.52 in Firefox for giggles, and got a response from a cheap router,TD854W.
so then I decided to check against my webserver, what my IP is, via the access logs, which threw back my normal IP address.
Next, I used dig, nslookup, and whois which shows me a recurring theme that my traffic is headed through a totbb.net ;; ANSWER SECTION: 184.108.40.206.in-addr.arpa. 80 IN PTR node-1dtu.pool-182-53.dynamic.totbb.net.
This all seems suspicious to me. As an East coast denizen, having my traffic go through Bangkok seems peculiar. The TD854W isn’t exactly ISP class hardware. and I'm just totally sketched out at the moment.
Any words of wisdom? Am I just being paranoid? Should I be looking for something else? I have a proprietary ZHONE modem at home, I have no idea how to determine if it has been compromised, and there is no determinable interface I can find. Should I contact my ISP about this?