I need some objective minds in a little scenario. Ok this actually happened but I like to know what do you think when you see this on your router A quick Google of the Ip gimme the following IP address information: http://www.magic-net.info/blacklist_lookup/18.104.22.168 Blacklist lookup January 14 2011.html Complaint lodged for 22.214.171.124 are a lot of people complaining bout the same ip port scanning. I assume its picked up by their routers firewall. Heres the list http://www.liveipmap.com/126.96.36.199 Complaint lodged for 188.8.131.52 Dated back from 7 months ago to couple of weeks. Then I came across this thread of another user picking up the following http://forums.majorgeeks.com/showthread.php?t=229454 Luckily Avira notified him and he had it checked out. The thread was also bout 8 months ago. Further one the following was found on his pc Now is it a stupid hacker using the same old ip for months on end or does that IP look like something part of a botnet or would you dismiss it as a plain and normal port scan?