Port Scan* detected from

keat63

• July 07, 2016 02:15

Over the last 5 days or so, I'm seeing quite a number of port scans detected in CSF, all originating from various random IP's in the UK. I have CSF configured to block the IP based on 10 or more port scans. My question really is, could normal day to day web usage or operations generate port scans or emulate something that looks like a port scan. Would there be any implications (maybe in the short term) to reduce this down to 3 ?

• 

  keat63

  • July 11, 2016 07:07

  I'm receiving at least 40 of these port scans per day, the odd thing is that 99% of them are coming from various IP's all belonging to Virgin ?? Could anyone help explain this at all. eg: *Port Scan* detected from 92.238.xx.xxx (GB/United Kingdom/Bradford/Shipley/cpc29-brad20-2-0-cust248.17-1.cable.virginm.net). *Port Scan* detected from 86.30.xx.xxx (GB/United Kingdom/Glasgow City/Glasgow/cpc3-kirk3-2-0-cust81.14-1.cable.virginm.net).

  0
• 

  cPanelMichael

  • July 11, 2016 12:13

  Hello, It's possible the traffic stems from FTP usage, as referenced on the following thread: Port scanning detected while donig ftp Thank you.

  0
• 

  keat63

  • July 11, 2016 12:57

  There's only myself who has FTP access, and I don't use Virgin. There have been email issues with the Virgin Media servers recently, and I've been heavily involved on the Virgin forum to try and help have this issue resolved. I did post my IP address on one post, so i'm wondering if all this traffic might be generated through the forum post somehow. Maybe the forum server is trying to resolve the IP ??

  0
• 

  Infopro

  • July 11, 2016 13:05

  Possibly. This is an example of why you should never post actual IPs, emails or domain names to any public forum, anywhere. You might ask the moderators over there if they'll edit your post(s) if needed.

  0

Please sign in to leave a comment.