Thanks.
Jul 28 18:35:19 daemon alert kernel: Intrusion -> IN=pppoa0 OUT= MAC= SRC=50.161.128.217 DST=122.58.102.209 LEN=52 TOS=0x00 PREC=0x00 TTL=110 ID=1560 DF PROTO=TCP SPT=51533 DPT=51546 WINDOW=8192 RES=0x00 SYN URGP=0 MARK=0x8000000
This is happening every few minutes as per the screenshot below.

Oh here's one bizarre thing. I can log (VNC) in to my media machine via 4G connection, using Screens Connect. But then I remotely open Safari on the machine, it often cannot load webpages. I don't understand at all!
Cheers,
Joseph