Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

[Anonymous]

Sorry with putting ISP, it's the number that's issued for internet use IP address.

I can reset the router with a pin and it gives the same number out or just alters the last 3 digits, same if I turn router off for a hour, unplug from mains and then put it back on. Would just be nice to receive a totally new number to see if these attacks stop, although even a number with it being used by someone before could have the same thing happening to it.

I only have 2 devices,  computer and new TV. The TV's internet has been totally turned off for the last 2 weeks so it's impossible for that to send out or receive any data and installing an anti virus from the play store says it is clear. As mentioned 5 different highly rated anti virus companies software said my computer was totally clear, but I still reformatted it to be on the safe side and also reset the memory to make sure nothing nasty was stored in there, so I can't think of anything else to do my side that I haven't done already. Changed all passwords etc.. Just concerned if it is safe to turn the internet back on my TV, I've stopped using the 2 DECT phones BT sent out to me as I was convinced it was those sending the IP address back somewhere (or if they have Mac addresses could someone track you down through those phones). I'm using my old landline via the adaptor now instead. Is it possible for someone to track you down via a Mac address? I've not installed anything new, not clicked on dodgy links or e-mails, but if someone has your computers Mac address, is that why they keep getting the IP addresses allocated? It could be something simple as its just a case that the IP addresses BT give out to me were already being attacked, but I am worried sick with regards to safety, as I'm sure anyone else would be in the same situation 😞

[countrypaul]

Dect phones do not use IP to communicate they use Dect . Dect phones also do not have Ethernet MAC addresses as they use Dect to communicate to the base station. If you plug a dect phone base station into the SH2 it is using the old telephone system means of communicating with the SH2 - again no ip address and no MAC address.

Only the SH2 has a MAC address (on FTTP) if you are using the telephone connected via the SH2 either by Dect of the phone socket on the SH2. The connection from the SH2 to the ONT is ethernet so the SH2 will have a MAC address to communicate with the ONT.

MAC addresses are not normally sent outside of the ethernet they are on so there would be no point in trying to trace a MAC address from your own ethernet. If you connect to a public WiFi system then your MAC address could be available to others which is why more recent operating systems allow MAC randomisation.

[Crimliar]

If the OP wants to know for sure if they have a compromised device, then the way to test this would be to power down ALL devices that connect to the router.  Then reboot the router, and power up individual devices one at a time with maybe a (suggestion) 5 minute interval, with the connected PC being last.  The use the logs to see when the DoS attack takes place.

[Anonymous]

I have tried that, but since the router keeps giving me either the exact same number, or the same with the last 3 digits altered, the attackers are going for the entire range. I have rang technical loads of times and also this safety and fraud team (total waste of time as the bloke didn't want to know at all). The only way to rule things out would be to get a totally different IP address that starts with a different set of numbers, hopefully that way the IP address has not already been compromised and already under attack in the past, but having tried desperately for the last couple of months to try to get a new number, nothing has worked. Not sure if moving to a different package already offered to me would give a new IP address? If it does then that's the only sensible option, as otherwise BT basically are not remotely interested in these cyber attacks or whatever you want to call them. Had another 70 port scans middle of the night 1am, 3am, 6am, 4 UDP loopbacks (China yet again early morning), 3 DOS spoofing and one said Flood after it, then another UDP port scan 1pm.

[c64z86]

With entirely new IPV4 addresses being extremely rare these days, the chances are slim that you will get one which has not been attacked in the past.

Even if you did get a new one, it will shortly be compromised. Just going out into the internet puts a big target on your back for anyone willing to exploit the vulnerabilities of your network and accounts. Even my Steam account gets attacked a few times a year and I don't have any friends on it.

There are a lot more nefarious people and technologies being used for bad things on the internet than there were even 5 years ago.

[Crimliar]

And the idea was that by looking at the time you could tell if a compromised device is calling back home!
On the other side of things, this time yesterday I set up improved firewall reporting on my third-party router.  In around one day my router has been probed 900 times, and so far as I'm aware, nothing got through!

[Crimliar]

Addendum to my previous post!
A couple of hundred of those probes are from (low security) sites where in part I verify my identity using personal domain names and their associated IPs - not something many on here will be doing!  And yes it does mean there are a couple of vectors that if corrupted can prevent me from accessing those sites (until the corruption is fixed).

[steephill]

 You will just be wasting your time and energy trying to get a different IP address. The port scanning you are seeing isn't personal to you or even just to a range of BT addresses, the bots doing this are probing every IP address on the internet looking for weaknesses. Your router is doing its job in stopping these scans getting through and there is nothing more you, BT or any other ISP can do to stop whoever is initiating these port scans.

[Anonymous]

I see where you are coming from saying the bots doing this are probing every IP address on the internet looking for weaknesses. Just checking my router logs again, this new service went active back end of October 2023 and the DOS scans started on 22nd December and have continued everyday and night since.

Surely if bots scan addresses everyday, I would expect to have seen log entries prior to this December date and not have a good month and half plus free of no attacks at all, unless the IP address at the time given to me had never been under attack before and the last 2 different ones had been in the past, so I then picked these up when BT recycled them to me.

I can move to EE which was a choice given to me, not sure if that would make a difference at all, but I suppose it's worth a try :). Thanks for all the replies, if others are seeing similar scans in your routers as mentioned, I'm assuming it's a case of live with it and hope for the best. 

[licquorice]

The only way to stop ports scans is to not connect to the internet.

ALL IP addresses are regularly port scanned, you can't avoid it.

Just accept that it is going to happen and is why you have a firewall.