Open ports on unknown device

Hammertime

Thanks for everyone’s help on my last question.

I changed wifi password and username. Then did a Fing scan on my network and a device I was unaware of polled up “generic 10.0.079” I scanned for open ports and pinged it

This seems odd. Slave damean freaks me out. I looked on google but everything is in high tech Managua he and im not fluent. Any help for peace of mind or to rectify would be super appreciated.

best,

zach

Hronos

Hi @Hammertime!
If you change you Wi-Fi password and not updated it on any device you manage, it could be a wired device.
Some questions:
- Does your local network have that IP range? (10.0.0.xxx)
- Do you have a FingBox or just using the FingApp?
- iOS or Android version of the FingApp?
- Do you see the MAC Address of the device?

Hammertime

10.0.0.1 is IP

FingApp on IOS

no MAC address on device in question

Hronos

We are kind of limited with iOS, since 11 it doesn't let the FingApp know the MAC Address on the iPhone ARP table.
If you have a Mac or Windows machine, try to get the MAC Add
As @VioletChepil always say:

Here are some tips for identifying unknown devices:

https://community.fing.com/discussion/322/tips-for-identifying-generic-devices

VioletChepil

Hello all,
Fing desktop will hugely improve device recognition as well. 
This will be especially useful for iOS users on their home network with a desktop.  
@dev I wonder if you have anything to add on this one since you helped with the last device...

Shooter

Hi Hammertime,
Could your unknown device be a Samsung Smart TV? As Hronos suggested, this would account for a wired device via an Ethernet cable. 

VioletChepil

@Hammertime let us know if we can help any further on this one! 

Hronos

We are kind of limited with iOS, since 11 it doesn't let the FingApp know the MAC Address on the iPhone ARP table.
If you have a Mac or Windows machine, try to get the MAC Address of that device to research what it could be.
And as @VioletChepil always say:

Here are some tips for identifying unknown devices:

https://community.fing.com/discussion/322/tips-for-identifying-generic-devices

vulcansheart

I don't like the look of that TCP4000 being open. Unless you are playing Diablo or C&C, this is a commonly used backdoor port for trojan malware.

Crowgrandfather

If 8080 is open the try this

Http:10.0.0.79:8080

That will tell your computer to go to that port. 8080 is a comment http web server so if there's a webpage there you'll get to it.

The key though is that you need to find that device and fix it.

First off, are there any ports on on your router? Go to centralops.net and run a scan of your public ip.

Next try to log into your router and see if it can give you a MAC address for what's at that IP.

vulcansheart

Crowgrandfather said:

If 8080 is open the try this

Http://10.0.0.79:8080

That will tell your computer to go to that port. 8080 is a comment http web server so if there's a webpage there you'll get to it.

The key though is that you need to find that device and fix it.

First off, are there any ports on on your router? Go to centralops.net and run a scan of your public ip.

Next try to log into your router and see if it can give you a MAC address for what's at that IP.

Forgot the double-backslash:

http://10.0.0.79:8080

Also, @Hammertime if you have a Fingbox, it should already have some port scanning results ready to consult to see if anything has maliciously punched a hole in your firewall. UPnP does this a lot, so that's the ports you'll want to look for.

vulcansheart

Crowgrandfather said:

If 8080 is open the try this

Http://10.0.0.79:8080

That will tell your computer to go to that port. 8080 is a comment http web server so if there's a webpage there you'll get to it.

The key though is that you need to find that device and fix it.

First off, are there any ports on on your router? Go to centralops.net and run a scan of your public ip.

Next try to log into your router and see if it can give you a MAC address for what's at that IP.

Forgot the double-backslash:

http://10.0.0.79:8080

Also, @Hammertime if you have a Fingbox, it should already have some port scanning results ready to consult to see if anything has maliciously punched a hole through your firewall. UPnP does this a lot, so that's the ports you'll want to look for.