Hacker News Reader

Ports 5431 and 1900 are used for UPnP.

I can’t think of any good reason they should be listening on an external interface, but maybe the port scanning is happening on the inside.

That's the thing, it looks like they are listening externally: https://www.shodan.io/search?query=Server%3A%20Custom%2F1.0%.... I tried a couple of those IPs and can reach all of them on 5431.

Yeah, DNS rebinding attacks can allow malicious Javascript running inside the network attack the router from the LAN side.