it has an "Ignore Anonymous IP addresses" turned on. None of these IPs had hostnames, so I assume that makes them anonymous?

I still have the virtual server turned off, my normad.com domain goes to the router, which means it doesn't go to a server. All ports will now be seen as being switched off. SBC kind of blocked server protocols anyway so my web page at that address didn't load all the way, you'd get the main HTML, but they blocked the images and other things. I have a AMD Thunderbird 1.1 Ghz 512M system with a 40G drive running W2K Server over there. Had my father use it while I rebuild his system. A shame that SBC blocks server access on their DSL dynamic IP lines. They could be trying to hack into the normad.com web server, not that I have anything important there, just some PHP and ASP scripts I wrote.