Ummm, router log does not seem right, help plz :(

Hi, Not sure if this is the right place to ask :/ but ive had trouble before and this place is the best at fixing the problem. Anyway I checked my router log today routinely and noticed this had been going on throughout the day. I usually see this but not from the same ips constantly. Also my computer was not even on at the time of half of these blocked connections just the router on its own, which leads me to believe my comp is clean. Ive scanned it with spybot, malwarebytes and norton and everything hit 0 found… so whats going on :/ ? thanks alot [INFO] Fri Oct 29 23:58:32 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:6588 [INFO] Fri Oct 29 23:58:32 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:7212 [INFO] Fri Oct 29 23:58:32 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:73 [INFO] Fri Oct 29 23:58:32 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8008 [INFO] Fri Oct 29 23:58:32 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8000 [INFO] Fri Oct 29 23:58:32 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8090 [INFO] Fri Oct 29 23:58:32 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9000 [INFO] Fri Oct 29 23:58:32 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9090 [INFO] Fri Oct 29 23:58:32 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:3246 [INFO] Fri Oct 29 23:58:32 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:2479 [INFO] Fri Oct 29 23:47:51 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:6588 [INFO] Fri Oct 29 23:47:51 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8008 [INFO] Fri Oct 29 23:47:51 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8118 [INFO] Fri Oct 29 23:47:51 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:2301 [INFO] Fri Oct 29 23:47:51 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8000 [INFO] Fri Oct 29 23:47:51 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8090 [INFO] Fri Oct 29 23:47:51 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:27977 [INFO] Fri Oct 29 23:47:51 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9090 [INFO] Fri Oct 29 23:47:51 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9000 [INFO] Fri Oct 29 23:47:51 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8085 [INFO] Fri Oct 29 23:47:34 2010 Blocked incoming UDP packet from [removed]:45036 to xx.x.xxx.xxx:32657 [INFO] Fri Oct 29 22:09:23 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8088 [INFO] Fri Oct 29 22:09:23 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:3246 [INFO] Fri Oct 29 21:51:38 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8088 [INFO] Fri Oct 29 21:51:38 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8000 [INFO] Fri Oct 29 21:51:38 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9090 [INFO] Fri Oct 29 21:51:38 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9000 [INFO] Fri Oct 29 21:51:38 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:3246 [INFO] Fri Oct 29 21:51:38 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:2479 [INFO] Fri Oct 29 21:51:38 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9415 [INFO] Fri Oct 29 21:51:38 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8085 [INFO] Fri Oct 29 19:44:29 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:73 [INFO] Fri Oct 29 19:44:29 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8000 [INFO] Fri Oct 29 19:44:29 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8090 [INFO] Fri Oct 29 19:44:29 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9000 [INFO] Fri Oct 29 19:44:29 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9415 [INFO] Fri Oct 29 19:44:29 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:27977 [INFO] Fri Oct 29 19:44:29 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8085 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8008 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8118 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:2301 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8000 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8090 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:27977 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9090 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9000 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:3246 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:2479 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9415 [INFO] Fri Oct 29 19:31:08 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8085 [INFO] Fri Oct 29 18:12:10 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:7212 [INFO] Fri Oct 29 18:12:10 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:73 [INFO] Fri Oct 29 18:12:09 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8000 [INFO] Fri Oct 29 18:12:09 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8090 [INFO] Fri Oct 29 18:12:09 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9415 [INFO] Fri Oct 29 18:12:09 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:27977 [INFO] Fri Oct 29 15:47:52 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:6588 [INFO] Fri Oct 29 15:47:52 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:8088 [INFO] Fri Oct 29 15:47:52 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:3246 [INFO] Fri Oct 29 15:47:52 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:2479 [INFO] Fri Oct 29 15:47:52 2010 Blocked incoming TCP connection request from [removed]:12200 to xx.x.xxx.xxx:9415 In addition to all these types of messages there is also alot of these [INFO] Fri Oct 29 12:25:45 2010 Blocked incoming TCP packet from [removed]:5050 to xx.x.xxx.xxx:52209 as PSH:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:42 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56174 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:38 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56173 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:38 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56172 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:38 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56171 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:37 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56175 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:32 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56174 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:28 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56173 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:28 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56172 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:28 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56171 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:27 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56175 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:22 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56174 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:18 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56173 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:18 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56172 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:18 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56171 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:17 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56175 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:12 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56174 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:10 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56173 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:10 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56172 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:10 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56171 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:10 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56175 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:07 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56174 as FIN:ACK received but there is no active connection [INFO] Fri Oct 29 12:25:06 2010 Blocked incoming TCP packet from [removed]:80 to xx.x.xxx.xxx:56173 as FIN:ACK received but there is no active connection

Looks like someone is trying to bypass your firewall. It also looks like it's automated, you can tell because the log times are almost identical. No human could ping you that quickly. If you look closely there are actually two IP's : [removed] [removed] I did a little check, and they both come from the same ISP, in Beijing, China. I'm no network security expert, but if this was my router, I would be alarmed. Phone up your ISP and request them to block any connections from those two IP's. If you can, get them to block anything from the "CHINANET JIANGSU PROVINCE NETWORK" ISP. ISP's buy IP's in bulk, so it should be fairly easy to block any connection from a particular ISP. Let us know how it goes. Cheers, Nahumi P.S. Do you have a log of your "usual" activity?

i'm no security expert but to be honest i don't think there's much to be worried about and your router is doing it's job fine and blocking them all.