An intrusion attempt by linuxoutsideextremeslip.xyz was blocked and I received an Alert from Norton which says:
Severity Activity Date & Time Status Recommended Action
● High An intrusion attempt by linuxoutsideextremeslip.xyz was blocked 3/3/2017 1:14:00 PM Blocked No Action Required
Advanced Details
IPS Alert Name Web Attack: Fake Scan Webpage 29
Default Action No Action Required
Action Taken No Action Required
Attacking Computer linuxoutsideextremeslip.xyz (160.153.162.194, 80)
Attacker URL linuxoutsideextremeslip.xyz
Destination Address HP-PC (192.168.0.4, 58045)
Source Address linuxoutsideextremeslip.xyz (160.153.162.194)
Traffic Description TCP, www-http
Here are a few of my thoughts/questions to the community (perhaps someone knowledgeable might help me):
1) I did a Google search and found that this is not the first time an intrusion like this has happened. But google were able to find only a handful of cases/reports with similar situation. What can I/we do to stop this nonsense from happening again?
2) Apparently, the attacker has a known web address as shown above. Is it possible someone or somehow we can identify him/her to the law enforcement?
3) I just wonder what is the destination address of "192.168.0.4, 58045" mean? Is this the address of my computer (looking from my LAN) or is it something more specific (such as one of my hard drive)?
4) Am I safe from similar intrusions from some other attackers? I other words, can I trust Norton to always being able to catch something like this?
5) Not long ago, I mistakenly downloaded and installed a "malware" entitled Firefox-patch.js which seemed to me like a legitimate patch from Mozilla Firefox. It has since caused print looping errors and prevented me from using print function on all e-mails in my gmail. I am wondering if today's intrusion has something to do with that virus? (For example, during the installation of that Firefox-patch.js, it brought up a command prompt window and showed a command: "ping -n 4 localhost". The number "4" in this command seems to imply/coincide with the intrusion destination address of 192.168.0.4.)
Thanks for reading and any comments/help is appreciated.
Tong