Ipv4scan.com?

donb2012

Senior Member
#1
About 15 minutes ago with me not doing anything my printer printed something from ipv4scan.com. This has never happened before in all my years of computer use (freaked me out). Who and what is ipv4scan.com? below is what was printed,

Get http://ipv4scan.com/hello/check.txt HTTP/1.1
Host: ipv4scan.com
Accept-Encoding: gzip, deflate, compress
Accept: */*
User-Agent: IPv4Scan (+IPv4 Scan: Scanning the Web for Open Proxy Servers)
 


kemical

Windows Forum Admin
Staff member
Premium Supporter
Microsoft MVP
#2
Sounds like a malware attack of some sort. I tried to check out ipv4scan.com and Malwarebytes Pro flashed up. Try running the free version:
https://www.malwarebytes.org/
 


Sonny

Excellent Member
#3
It won't show up on malwarebytes free.
after clicking on the last link he had above. I ran malwarebytes and nothing came up. However when I went to get into another web page, I found out it changed my IP configuration.
 


#4
I woke-up just now (April 29th 8 am MDT) to the same print-out in my printer. I have a Dell PC.
Yesterday I was listening to a computer geek show on the radio and before he went on commercial break he said,'If you're on your computer, using Explorer get off NOW!'. I got to my destination and forgot about it. hmmmm
 


kemical

Windows Forum Admin
Staff member
Premium Supporter
Microsoft MVP
#5
I had a quick through google and found surprisingly little although was in a bit of a rush..
 


kemical

Windows Forum Admin
Staff member
Premium Supporter
Microsoft MVP
#6
This however looks related and is definitely not looking good:

Here we discuss the user-agent string, which identifies your browser and provides certain system details to servers hosting the websites you visit.
http://msdn.microsoft.com/en-us/library/ms537503(v=vs.85).aspx
 


#7
Apparently, Microsoft is advising people in the Denver, CO area to use a different Browser than IE until May 13th when Microsoft will have an update to fix the malware. Check today's (Tuesday, April 29, 2014) Denver Post for more information.
 


#8
I just got in to work and saw this on our main printer, I also noticed that the server was OFF too, which has me wondering if the our server got hacked. It's also on a battery backup and i find it strange that it was off while the other two computers that aren't on battery back up was on.
 


donb2012

Senior Member
#9
Apparently, Microsoft is advising people in the Denver, CO area to use a different Browser than IE until May 13th when Microsoft will have an update to fix the malware. Check today's (Tuesday, April 29, 2014) Denver Post for more information.
Weird, I don't live anywhere near Denver,Co. I guess it's a Microsoft thing and not a specific location situation.
 


#10
Here's little more on this, though the MS page @kemical posted shows the user agent strings posted to the printer during the scan. We used to get these on public facing printers while most of the computers in our labs at Idaho State University would drop the traffic with the firewall if they were on a public-facing subnet. Printers, however, liked to get scanned and tell us about it.

https://www.tmk.com/blog/?p=680
 


This website is not affiliated, owned, or endorsed by Microsoft Corporation. It is a member of the Microsoft Partner Program.