Should random people joining EQBC worry me?

[mrhorrn]

Recently I've been getting quite alot of this:

EQBCS (EQ Box Chat Server) 1.2.v1
Waiting for connections on port: 2112...
-- Client connection: fd 260
-- has joined the server.
Ú!┤ JJ‼☺‼☻‼♥└+└/└,└0╠®╠¿└‼└¶ £ Ø / 5☺ ☺ôÜÜ ↨  ☺ ☺
-- has left the server.
-- Client connection: fd 264
-- has joined the server.
<> qËIøÝ ô☺═♫6y☺«ìp´╬ H¼@☼↓‼├¬Ñ¸☻G┴_░®J¥÷íêjwdÓ¼eW┤R◄8 "::‼☺‼☻‼♥└+└/└,└0╠®╠¿└‼└¶ £ Ø / 5
-- has left the server.


The names are always a complete mess of symbols, but it's more the joining and leaving that i'm worried about.

It hasn't happened in all the years I've had it installed up until a few months ago, so i know it's not normal...

[Muergan]

are you using 127.0.0.1 to join as a localhost or are you using an external ip? There are ways to let outside people join an eqbc server but it would have to be setup and not just stock settings. As far as randoms joining i have never experienced that before personally.

[mrhorrn]

Yeah it's all localhost. Noone set up to join externally nor even from another machine on the same network, its all default install with no other firewall rules or port forwarding in place.

[Nexor]

Do your start EQBC as service or via exe ?

Do those connection happen only do the time you try to start a EQ client ?
Ever left EQBC open without playing and than you noticed those connections ?

[mrhorrn]

EQBCServer.exe is pinned to the taskbar and it starts via that.
The connections when i start a client actually show properly, ie, include the character name joining and leaving.
The app is pretty much running from machine start up to machine reboot, which could be weeks or months between.. so for all intents and purposes it's running full time. All these connections happen when im not playing.

[Nexor]

Well i would say check your router logs for acesss to your computer from outside your network.

[joffy]

I would say double check and make sure that computer is not setup as a DMZ accidentally (or on purpose). I've setup a dmz to some static ip for testing, then forgot about it, used that same ip on another computer and forgot I was putting it on the Internet with its pants down.

Also possibly anit-virus? You could disconnect from the internet while you are not using the computer, and see if the connections still happen, if they do still happen with no internet/network, you know the call is coming from inside the house! I'd then shut off antivirus and see if the connections stop happening. Maybe M$ windows defender too. If you aren't on the network, it should be safe to try. I'd keep shutting programs/services down until they stop. I don't know how often they happen though, so that could be tough to do.

Another thing could be smart devices or streaming like a ps3 with a media streamer or something thats trying to hit your device on 2112. If you use a static private ip, maybe try changing it to something else to see if it still happens. Sorry I troubleshoot a lot for work and usually just have to throw everything including the kitchen sink at problems.

[mrhorrn]

It all started when the ISP bot scams started going around Twitch, so i wonder if i got hit and these are port scans.

I've rebooted my router as to reset my IP but i think the logs get wiped with the router reboot, so i'll have to keep an eye.

Thanks for your input, i'll definitely keep an eye and see what i can find.