Unrecognized connections

**aligator12** · June 25th, 2012

Originally Posted by leoquant

91.189.89.22(:80) is ubuntu/canonical
geo-ip = ubuntu/canonical
i don't see any strange things.
74.125.45.99= google inc.

What about 107.14.43.169?

**Soul-Sing** · June 25th, 2012

Originally Posted by aligator12

What about 107.14.43.169?

a US Internet service provider (ISP) (Road Runner HoldCo LLC)

**aligator12** · June 25th, 2012

Originally Posted by leoquant

a US Internet service provider (ISP) (Road Runner HoldCo LLC)

I know, but I don't use Road Runner, I use a different isp. But the thing is, is that I have received a good bit of spam in 3 separate email accounts from rr.com and now I notice that connection.

**Soul-Sing** · June 25th, 2012

Originally Posted by aligator12

I know, but I don't use Road Runner, I use a different isp. But the thing is, is that I have received a good bit of spam in 3 separate email accounts from rr.com and now I notice that connection.

but you did start this thread with

I was browsing the web and got jacked to the website jobs.retailjobsweb.com.

why did you think your jacked? other than the information you gave us?

your additional information:

But the thing is, is that I have received a good bit of spam in 3 separate email accounts from rr.com and now I notice that connection

How serious is this spam? I mean who doesn't receive spam from time to time......

**aligator12** · June 25th, 2012

why did you think your jacked? other than the information you gave us?

Because I was browsing a seedy site with lots of ads.

How serious is this spam? I mean who doesn't receive spam from to time......

Well, I created 3 separate yahoo email accounts (one I only used to register to this site) and everyone of them began receiving spam from rr.com.

And how do I see every outgoing connection? Because every command I have run so far creates a log so large it cuts off.

**Soul-Sing** · June 25th, 2012

Well, I created 3 separate yahoo email accounts (one I only used to register to this site) and everyone of them began receiving spam from rr.com.

you could block the ip address via ufw/gufw.
you think you'r "infected" but netstat,

Code:

netstat -netp

or

Code:

watch netstat -netp

gives no information you'r in danger. Not every ip adress showing up is a "danger".

if you want to harden your system please read this wiki:

https://wiki.ubuntu.com/BasicSecurity
learn about ufw/gufw,netfilter, and inbound/outbound rules.

take your time to get fam. with this stuff. and relax.

just because i am curious, what gives:

Code:

netstat -taupen

**aligator12** · June 25th, 2012

gives no information you'r in danger. Not every ip adress showing up is a "danger".

Well if you think I am fine, then I will take your word for it. But I have one more question out of curiosity, why do I have so many connections to google?

**CharlesA** · June 25th, 2012

They are in the TIME_WAIT status, it's normal.

That netstat looks fine to me.

**emiller12345** · June 27th, 2012

Originally Posted by aligator12

why do I have so many connections to google?

Google is massively integrated. Just about every website you go to has been integrated with google. Even your firefox browser has default built in links to http://safebrowsing.clients.google.com (in the about:config section). It is very hard to not connect to google.