07/06/2026
reluctantly, I oppose hacking but hacked a few criminal/terrorist/person/towels hackers tonight and worked out a script for powershell as does this command to keep them out of OUR life.
— it **records all foreign (non‑LAN) TCP connections** with timestamps, ports, state, PID, 9nd process name.
If your goal is to **improve, harden, or extend** this monitor, I can take it much further. It lasts forever. But, if you start your computer up again you'll need to put the command in.
- Trust Me it's what I get paid for by the NSA as CPSVO (head)
------------------------------------------------------------------------------------------------------------------------------------------------------------
Enhanced Foreign Connection Monitor (PowerShell)
Tracks only new foreign connections and enriches them with GeoIP + ASN. (Command) therefore it is always.
------------------------------------------------------------------------------------------------------------------------------------------------------------
COMPLETE: **endpoint network forensics**.
---
CFA Spyware
All programmed by me, the best, Clif Leon Prosser
The Chaser.
--------------------------------------------------------------------------------------------------------------------------------------------------------------
# === CONFIG ===
$log = "$env:USERPROFILE\Desktop\ForeignConnections_$(Get-Date -Format 'yyyy-MM-dd_HH-mm').txt"
"=== Foreign Connection Monitor Started: $(Get-Date) ===" | Out-File $log
# Cache to avoid duplicate entries
$seen = @{}
# Function: GeoIP lookup (uses ipinfo.io)
function Get-IPInfo {
param([string]$ip)
try {
$url = "https://ipinfo.io/$ip/json"
$data = Invoke-RestMethod -Uri $url -TimeoutSec 4 -ErrorAction Stop
return "$($data.country) | $($data.org)"
} catch {
return "Unknown"
}
}
while ($true) {
$connections = Get-NetTCPConnection |
Where-Object {
$_.RemoteAddress -notlike "127.*" -and
$_.RemoteAddress -notlike "192.168.*" -and
$_.RemoteAddress -notlike "10.*" -and
$_.RemoteAddress -ne "::"
}
foreach ($c in $connections) {
$key = "$($c.RemoteAddress):$($c.RemotePort)-$($c.OwningProcess)"
if (-not $seen.ContainsKey($key)) {
$proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
$geo = Get-IPInfo $c.RemoteAddress
$entry = "[{0}] {1}:{2} → {3}:{4} | {5} | PID {6} | {7} | {8}" -f `
(Get-Date), $c.LocalAddress, $c.LocalPort, $c.RemoteAddress, $c.RemotePort, `
$c.State, $c.OwningProcess, $proc.ProcessName, $geo
$entry | Tee-Object -FilePath $log -Append
$seen[$key] = $true
}
}
Start-Sleep -Seconds 5
}
------------------------------------------------------------------------------------------------------------------------------------------------------------
Send a message to learn more
