opening and closing port 80 – a test

Well, as you might remember, having migrated all of the self-hosted websites to the Arizona host from the Rugby infrastructure (so there are no domains pointing to the static IP address here), I closed port 80 on the router.

That was a week ago.

This evening, just for a laugh, I opened port 80 on the router. You have to remember that there are no domains hosted in Rugby, so there can be nothing pointing to a domain inside the router.

As soon as I saved the new #open port 80# config on the router, the port 80 calls started appearing:

[LAN access from remote] from 123.125.71.13:20876 to 192.168.1.9:80 Thursday, Feb 27,2014 17:47:41
[LAN access from remote] from 220.181.108.99:33261 to 192.168.1.9:80 Thursday, Feb 27,2014 17:43:59
[LAN access from remote] from 116.83.69.235:48491 to 192.168.1.9:80 Thursday, Feb 27,2014 17:42:49
[LAN access from remote] from 186.93.250.149:60705 to 192.168.1.9:80 Thursday, Feb 27,2014 17:18:47
[LAN access from remote] from 186.93.250.149:60300 to 192.168.1.9:80 Thursday, Feb 27,2014 17:18:46
[LAN access from remote] from 186.93.250.149:60125 to 192.168.1.9:80 Thursday, Feb 27,2014 17:18:45
[LAN access from remote] from 186.93.250.149:59920 to 192.168.1.9:80 Thursday, Feb 27,2014 17:18:44
[LAN access from remote] from 186.93.250.149:59862 to 192.168.1.9:80 Thursday, Feb 27,2014 17:18:44
[LAN access from remote] from 179.60.148.11:34017 to 192.168.1.9:80 Thursday, Feb 27,2014 17:18:38
[LAN access from remote] from 220.181.108.78:15213 to 192.168.1.9:80 Thursday, Feb 27,2014 16:53:14
[LAN access from remote] from 123.125.71.17:54235 to 192.168.1.9:80 Thursday, Feb 27,2014 16:52:23
[LAN access from remote] from 179.60.148.11:55732 to 192.168.1.9:80 Thursday, Feb 27,2014 16:30:56
[LAN access from remote] from 220.181.108.100:50027 to 192.168.1.9:80 Thursday, Feb 27,2014 15:43:21
[LAN access from remote] from 123.125.71.17:16481 to 192.168.1.9:80 Thursday, Feb 27,2014 15:42:36
[LAN access from remote] from 123.125.71.45:53286 to 192.168.1.9:80 Thursday, Feb 27,2014 14:46:49
[LAN access from remote] from 220.181.108.117:14815 to 192.168.1.9:80 Thursday, Feb 27,2014 14:43:55
[LAN access from remote] from 123.125.71.45:30651 to 192.168.1.9:80 Thursday, Feb 27,2014 13:55:58
[LAN access from remote] from 220.181.108.90:51256 to 192.168.1.9:80 Thursday, Feb 27,2014 13:48:08

So, it’s safe to assume that all of these (and probably most of the historic) ┬áport 80 calls are routing to the static IP address configured inside the router, not to any domain name.

Interesting.

Bookmark the permalink.

2 Responses to opening and closing port 80 – a test

  1. Allister says:

    Interesting. I wonder if they simply probe port 80 across the entire address range until they get a response and then have at it. If this is the case, I suspect IPv6 will reduce this due to the rather larger address range.

    • Whoops! says:

      Yep, that’s exactly the way I read the situation too. So I guess that all IP addresses are crawled, and as soon as there’s a response, the bots spider the IP address for any/all ports. It is, as you say, interesting.

Leave a Reply

Your email address will not be published. Required fields are marked *