unknown Camera traffic trying to access

[Dilbertic]

Hi All,

I was on my router and noticed a bunch of traffic on my cameras IP port adddress, I am not sure if this normal or not so I will post parts of the log. My camera is hosted via no-ip.com for outside password access viewing, so wondering if someone is trying to bot scan or something else is going on. I have no idea who this outside ip address is...

Logs:
[LAN access from remote] from 54.152.92.123:10023 to 192.168.x.xxx:8000, Friday, Jun 30,2017 12:22:43
[LAN access from remote] from 54.152.56.116:63701 to 192.168.x.xxx:8000, Friday, Jun 30,2017 12:21:51
[LAN access from remote] from 93.174.93.219:5900 to 192.168.x.xxx:5900, Friday, Jun 30,2017 12:18:19
-----------------
[LAN access from remote] from 75.140.57.34:52496 to 192.168.x.xxx:80, Friday, Jun 30,2017 12:03:23
[LAN access from remote] from 75.140.57.34:52495 to 192.168.x.xxx:80, Friday, Jun 30,2017 12:03:23
[LAN access from remote] from 75.140.57.34:52494 to 192.168.x.xxx:80, Friday, Jun 30,2017 12:03:23
[LAN access from remote] from 75.140.57.34:52493 to 192.168.x.xxx:80, Friday, Jun 30,2017 12:03:23
[LAN access from remote] from 75.140.57.34:52492 to 192.168.x.xxx:80, Friday, Jun 30,2017 12:03:23
[LAN access from remote] from 75.140.57.34:52491 to 192.168.x.xxx:80, Friday, Jun 30,2017 12:03:22
[LAN access from remote] from 75.140.57.34:52490 to 192.168.x.xxx:80, Friday, Jun 30,2017 12:03:22
------------
[LAN access from remote] from 186.2.166.204:49219 to 192.168.x.xxx:80, Friday, Jun 30,2017 11:28:25
[LAN access from remote] from 186.2.166.204:7280 to 192.168.x.xxx:80, Friday, Jun 30,2017 11:28:25
[LAN access from remote] from 186.2.166.204:29869 to 192.168.x.xxx:80, Friday, Jun 30,2017 11:28:24
[LAN access from remote] from 186.2.166.204:4632 to 192.168.x.xxx:80, Friday, Jun 30,2017 11:28:24

 

[Dodutils]

So you opened incoming ports 8000... 5900 (VNC I guess) and 80 and you expect nobody will knock on your door ?

 

[alastairstevenson]

Your (unspecified) camera is being accessed as follows:
If it's Hikvision, you probably have the 'platform access' still enabled.

IP address 54.152.92.123
Reverse DNS (PTR record) ec2-54-152-92-123.compute-1.amazonaws.com

But when you expose the camera to the internet as @Dodutils states - expect to get loads of attempted access and eventually successful access, independent of how strong a password you set.
I'm surprised it's only a couple that you are seeing.

IP address 186.2.166.204
Location Belize City, Belize District, Belize (BZ)

Registry lacnic

IP address 75.140.57.34
Location Reno, Nevada, United States (US)

Registry arin

 

[Dilbertic]

So whats the best way to lock down my feed to no-ip.com. If I shut down the ports on I can't see the feed or am I doing this wrong?

 

[fvhjof]

Change port numbers to some random at Network -> Basic settings -> Ports

 

[alastairstevenson]

Change port numbers to some random at Network -> Basic settings -> Ports

Security by obscurity does not work.
And for a Hikvision camera (implied with the 8000 port) that can lead to instability.

So whats the best way to lock down my feed to no-ip.com.

It's not the feed you need to lock down - that's an outbound access.
It's the risky port forwarding you need to reconsider.

 

[Dodutils]

VPN is your answer