Ubuntu: Why is the IP “92.242.140.21” connecting to one of my ports? Is it Malware? [duplicate]



Question:

This question already has an answer here:

When I start up Chrome, "netstat -taupen" shows 92.242.140.21 connecting to a random port number, usually above 20,000. The IP is from the UK and is tied to Barefruit Ltd. Exactly what is connecting this IP to my computer when I use Chrome? If it has something to do with the ISP, I use Verizon.

Here is the terminal shows

Local Address        Foreign Address     State        User   Inode    PID/Program Name  192.168.1.3:33883    92.242.140.21:80     TIME_WAIT    0      0        -  

Also

Local Address        Foreign Address     State        User   Inode    PID/Program Name  192.168.1.3:33881    92.242.140.21:80     TIME_WAIT    0      0        -  


Solution:1

A small search will reveal that this IP belongs to Barefruit Ltd.

From Wikipedia:

Barefruit works with Internet Service Providers (ISPs) and major portals to use a range of software solutions which modify the ISPs DNS service such as the BIND software and also a specialist proxy solution known as a "Frootbox" to capture the errors and redirect its clients to navigation pages that may contain sponsored listings and algorithmic results. If a user clicks on a sponsored link, Barefruit and the ISP share the revenue.

So you can chillax - these guys work with your Internet Service Provider.

If you still don't feel happy about these guys, set up a firewall and use iptables to block one ip or a group

Best of luck !


Note:If u also have question or solution just comment us below or mail us on toontricks1994@gmail.com
Previous
Next Post »