NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Suspicious and Sudden IP Address Change by RN314 (a.k.a The Russians Are Coming)
Hey everyone,
I have been using my ReadyNAS 314 for several weeks with little to no problems. However, today my NAS spontaneously changed its IP address to 5.19.18.xxx from my usual internal IP address of 192.168.1.x. I see this change on Windows Explorer (Win 7). You can also see my old static connection for Music at the internal address. Am I being hacked? How can I fix the IP address back to my internal address?
I understand that having a dynamic IP from my cable provider can cause a change, but it should not change from an internal address pattern to one that is tracked to the Russian Federation! I am using ReadyCLOUD to access my data, but I have not made any unusual changes in the past few days such as switching to a VPN. Some people suggested in other posts that ReadyCLOUD uses Russian IP addressses. Is this true? https://community.netgear.com/t5/Legacy-NETGEAR-and-Partners-Add/Suspicious-IP-addresses-open-by-ReadyNasRemote-and-ReadyOpen/m-p/935204#M12733
I am not using ReadyCLOUD Remote, though.
Last week, I updated the firmware to the latest version OS 6.4.1. A few days ago, I deleted some files that the ReadyNAS said were virus infected. But, these files were 10+ years old and were not flagged by Windows Defender, BitDefender, or Kaspersky which I have run over the years. I did delete them immediately. Yesterday, I did notice a very big performance decline in ReadyCLOUD, but it is back to its normal performance today. To add to the mystery, as I was typing this over the past 10 minutes, the Russian IP has disappeared from Windows Explorer all on its own. I can still connect on the same local admin page through my browser, and the eth0 link still shows the same internal IP address.
Any clues to what is going on here?
Hi cleveland_rocks,
This IP address is generated through ReadyCLOUD and ReadyNAS remote. I suggest that you continue accessing your ReadyNAS files using its local IP address. Just wanted to know if you're seeing the same address in other local PCs?
Looking forward to your response.
Kind regards,
BrainL
NETGEAR Community Team
5 Replies
Replies have been turned off for this discussion
Hi cleveland_rocks,
This IP address is generated through ReadyCLOUD and ReadyNAS remote. I suggest that you continue accessing your ReadyNAS files using its local IP address. Just wanted to know if you're seeing the same address in other local PCs?
Looking forward to your response.
Kind regards,
BrainL
NETGEAR Community TeamHi BrianL,
No, the address 5.19.18.176 is nowhere to be found on any other machine. I was able to access the admin page from the same old internal address on my Mac and PC, so no issue there. I did type the new IP into my address bar and got a server timeout page. The new IP has not recurred on my Windows 7 machine. Now, the NAS name shows as normal with all shares accessible. Performance is back to normal. This is without ReadyCLOUD running.
You can see how the coincidence of the virus detection, a big performance hit, and a new IP would be concerning.
Thanks.
Hi cleveland_rocks,
Can you confirm if the ReadyCLOUD desktop app is still installed in the said machine? If yes, can you remove it and see if the 5.x.x.x address will show up in your network.
I look forward to your response.
Kind regards,
BrianL
NETGEAR Community Team
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
