I'm not sure why you're looking up a 172 IP address. The output is a host name not an IP.  c-24-91-141-173.hsd1.ma.comcast. net.  Is this your cable modem?

On Dec 16, 2012 12:09 PM, "Bill Mills-Curran" <bill@mills-curran.net> wrote:

I was looking at the output of "last" recently and found several
entries like this on my home server:

userxx  pts/0        c-24-91-141-172. Sun Dec  2 14:57 - 15:09 (00:11)

(userxx represents my username)

I did a reverse lookup on 172.141.92.24:

host 172.141.92.24
24.92.141.172.in-addr.arpa domain name pointer AC8D5C18.ipt.aol.com.

Looks like something from AOL.

I got a little freaked, so I changed my password and also blocked that
IP in /etc/hosts.deny.

I'm not an aol user, but my wife is...  but the "last" output shows
this as connecting with my username.

Any ideas?

Thanks,
Bill
_______________________________________________
Wlug mailing list
Wlug@mail.wlug.org
http://mail.wlug.org/mailman/listinfo/wlug

_______________________________________________
Wlug mailing list
Wlug@mail.wlug.org
http://mail.wlug.org/mailman/listinfo/wlug

-- 
David P. Connell
"Watch where you're going; remember where you've been."