R7000 DHCP question

[Java_man]

I checked my R7000 log this morning and saw this:

"[LAN access from remote] from 192.144.226.157:26559 to 192.168.1.2:80, Tuesday, Jun 28,2022 03:33:38"

Reading through the logs I see multiple entries like this with different IP address all "to 192.168.1.2"

I have DHCP turned on and the range begins at 192.168.1.2.

I have a list of devices that are Allowed and 192.168.1.2 is not one them.

Is this a problem I should be concerned about?

[FURRYe38]

Do a who is lookup on 192.144.226.157

What FW version is currently loaded? 

What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?

[Java_man]

Thanks for the reply. 

Netgear FW: V1.0.9.88_10.2.88

I looked up a couple of the IPs and they were an ISP in England - pptechnology.

Modem: Motorola Surfboard SB6120 connected to Comcast.

Also noticed they're all connecting to  192.168.1.2:80 (port 80 - the HTTP port). 

[Java_man]

Gotta step out for a couple hours.  I'll check in when I get back.

Thanks again.

[FURRYe38]

What devices has the address 192.168.1.2? 

[Java_man]

I did a little more digging in the logs.  Here are a few examples:

[LAN access from remote] from 2.57.122.209:17773 to 192.168.1.2:80, Monday, Jun 27,2022 07:37:33 PPTECHNOLOGY LIMITED

[LAN access from remote] from 185.196.220.70:50551 to 192.168.1.2:80, Monday, Jun 27,2022 07:10:34 = HOSTLICK - Germany (AbuseIPDB: This IP was reported 1,076 times. Confidence of Abuse is 12%)

[LAN access from remote] from 221.176.116.78:20647 to 192.168.1.2:80, Monday, Jun 27,2022 07:09:36 = China Mobile Communications Corporation - ISP (AbuseIPDB: This IP was reported 663 times. Confidence of Abuse is 100%)

[LAN access from remote] from 154.89.5.87:58914 to 192.168.1.2:80, Monday, Jun 27,2022 06:39:43 = AgotoZ HK Limited (AbuseIPDB: This IP was reported 1,132 times. Confidence of Abuse is 100%)

[LAN access from remote] from 128.1.248.46:18057 to 192.168.1.2:80, Monday, Jun 27,2022 06:35:25 = Zenlayer Inc (AbuseIPDB: This IP was reported 14,921 times. Confidence of Abuse is 100%)

[Java_man]

That's just it. . . none of them.  I pinged the address and get no reply messages.

It's not listed in my "Connected Devices" page in the Netgear software either.

[FURRYe38]

Hmmm...

[FURRYe38]

Would be curious to see what happens if you set the default DHCP IP address range to 192.168.1.100 to.200.

Has a factory reset and setup from scratch been performed since you updated FW? 

Something would be using .2 I believe. What browser are you using? Try MS Edge or Firefox and see what's seen in Connected Devices. 

[Java_man]

Pinging 192.168.1.2 with 32 bytes of data
Reply from 192.168.1.100: Destination host unreachable.
Reply from 192.168.1.100: Destination host unreachable.
Reply from 192.168.1.100: Destination host unreachable.
Reply from 192.168.1.100: Destination host unreachable.

Ping statistics for 192.168.1.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

[FURRYe38]

I would do this, turn OFF all devices accept for 1 wired PC. Change the Default DHCP IP address pool range as suggested. 

After you apply the change and the router reboot. Power OFF the ISP modem and router for 1 minute then back ON. 

I would leave all devices off accept for the 1 wired PC. 

Check the connected devices page on the router. You PC should be listed here. 

If it is, turn on 1 device. Let it connect, check the connected devices list again. If seen, check the log page for any LAN access entries. 

Graduate turning on devices one at a time and check the connected devices page. Take not of any device that doesn't appear on the page.

Check the log for any continue LAN access entries. 

[Java_man]

Earlier today I reset DHCP to begin range with 192.168.1.3.

I cleared the logs and will post when there are some entries.

[LAN access from remote] from 163.172.158.4:57501 to 192.168.1.2:80, Tuesday, Jun 28,2022 10:02:50

BUT, I just remembered I used to host a web server.  I searched some code that checked on the IP of the server and it was 192.168.1.2.  Took it offline years ago and it's not even connected. 

Thoughts?