Strange IP address

[Mike1116]

I am noticing a strange ip address associated with an iphone on my wireless access control page. The basic dhcp page has reserved an ip address of 192.168.0.11. The iPhone itself says it's address is 192.168.0.11 yet when I look at the wireless access control page it shows an ip address of 65.0.60.192. All other devices are 192.168.0.xx and are the same on both pages.
One last oddity if I turn wifi off and on on the iphone the access page shows a normal 192.168 address until I connect to the web. Then it changes to the 65.0.60.192. I am concerned about security. Thanks

 

[degrub]

MaBell
here is a WHOIS report
# start

NetRange: 65.0.0.0 - 65.0.63.255
CIDR: 65.0.0.0/18
NetName: BLS-65-0-0-0-1003020941
NetHandle: NET-65-0-0-0-2
Parent: BELLSNET-BLK9 (NET-65-0-0-0-1)
NetType: Reassigned
OriginAS:
Customer: SHV ADSL EEUA (C02435259)
RegDate: 2010-03-03
Updated: 2010-03-03
Ref: https://whois.arin.net/rest/net/NET-65-0-0-0-2


CustName: SHV ADSL EEUA
Address: 575 Morosgo Dr. NE
City: Atlanta
StateProv: GA
PostalCode: 30324
Country: US
RegDate: 2010-03-03
Updated: 2011-03-19
Ref: https://whois.arin.net/rest/customer/C02435259

OrgAbuseHandle: ABUSE81-ARIN
OrgAbuseName: Abuse Group
OrgAbusePhone: +1-919-319-8265
OrgAbuseEmail:

@att.net
OrgAbuseRef: https://whois.arin.net/rest/poc/ABUSE81-ARIN

OrgTechHandle: IPOPE3-ARIN
OrgTechName: IP Operations
OrgTechPhone: +1-888-510-5545
OrgTechEmail:

@att.com
OrgTechRef: https://whois.arin.net/rest/poc/IPOPE3-ARIN

RAbuseHandle: ABUSE81-ARIN
RAbuseName: Abuse Group
RAbusePhone: +1-919-319-8265
RAbuseEmail:

@att.net
RAbuseRef: https://whois.arin.net/rest/poc/ABUSE81-ARIN

RTechHandle: IPOPE3-ARIN
RTechName: IP Operations
RTechPhone: +1-888-510-5545
RTechEmail:

@att.com
RTechRef: https://whois.arin.net/rest/poc/IPOPE3-ARIN

# end

 

[eastavin]

I am noticing a strange ip address associated with an iphone on my wireless access control page. The basic dhcp page has reserved an ip address of 192.168.0.11. The iPhone itself says it's address is 192.168.0.11 yet when I look at the wireless access control page it shows an ip address of 65.0.60.192. All other devices are 192.168.0.xx and are the same on both pages.
One last oddity if I turn wifi off and on on the iphone the access page shows a normal 192.168 address until I connect to the web. Then it changes to the 65.0.60.192. I am concerned about security. Thanks

Is this page a report of the connection your device made to a home page on your iphone browser? If so it's connected to belsnet in Atlanta. https://www.whois.com/whois/65.0.60.192 . Does it change when u go to a different web site? (your note does not say what router and firmware u r using.)

 

[Mike1116]

The page I am looking at is from my router control screen. I logged into my router to assign some ip addresses to specific devices and noticed this anomaly.
The router is a Arriss SBG-6700AC. I will post the firmware info and hopefully some screenshots later.

Thanks for the reply

 

[Mike1116]

Below is a screenshot of the routers Basic DHCP page. The iPhone in question is at the bottom and is highlighted. On this screen it reports the ip address as I would expect 192.168.0.11. This is the same address that the phone itself is indicating as its ip address.

Below is a screenshot of the wireless access control page on the router, once again the iPhone is highlighted.

The Router is an Assis SBG6700-AC, Firmware D30GW-EAGLE-1.5.3.0-GA-00-NOSH

My cell carrier is ATT. I do not know how to read the WHOIS information but I do see ATT in there. The phone is connecting to the web through the router as far as I can tell. I am simply concerned that it has been hijacked in some way. Thanks a ton for the help.

 

[ColinTaylor]

My guess is that it's just showing the initial IP address that your phone asked for from DHCP. That will be the IP address it last had, which is probably the one it got from the AT&T mobile network.

You could try disabling the Wi-Fi on your phone and see what IP address AT&T gives you. Then re-enable Wi-Fi and see if that same IP address shows up on the router.

 

[Mike1116]

Thanks for the suggestion, unfortunately I don't know how to check the ip address with WiFi off.

 

[sfx2000]

Below is a screenshot of the routers Basic DHCP page. The iPhone in question is at the bottom and is highlighted. On this screen it reports the ip address as I would expect 192.168.0.11. This is the same address that the phone itself is indicating as its ip address.

Remove the DHCP reservation for the iPhone, and the problem will go away...

 

[Mike1116]

I have deleted the phone from the Dhcp page it simply appears again whenever a request for an ip address is sent to the router.

I am not even sure if there is a problem. The phone is working fine. I just noticed that it had a completely different ip address structure than all other devices on the network, thought that seemed odd, and perhaps indicative of some kind of hack. I haven't seen that you, smarter folks than me, feel like it's anything nefarious.

 

[ColinTaylor]

I have deleted the phone from the Dhcp page it simply appears again whenever a request for an ip address is sent to the router.

Try going into the wireless settings on the iPhone and "forgetting" the network and then setting it up again.

 

[Mike1116]

Yep tried that already. I reset network settings also.