Port Scanning

[gohighvoltage]

What is with all the port scanning lately? CSF has been blocking a ton of port scannings from IPs from all over the world. Just last night 32 were blocked.

about 30% of them are from IP's in the US. Is there that many attempts to hack into servers all the time?

[gohighvoltage]

Also, I had my CSF and LFD set to medium security, I just now changed it to High Security, is this the best option?

[JPC-JamesG]

Hello,
Whenever I run CSF on my own personal servers, I always set it to high security and I lock down SSH to a few single IP addresses that I can access from AND i change SSH to a non-standard port (41414 usually).

Hacking is on the rise - I have no idea why there has been such an increast, these IPs could be associated with a proxy server which could be being used from china or elsewhere in the world, try looking them up on What Is My IP Address? Lookup IP, Hide IP, Change IP, Trace IP and more...

To go a little deeper in your CSF, its really up to you and totally depends on what applications you are running, wether you want your server to respond to ping requests and what ports you want open. You'll notice on the configuration page for setting the level all the different options between low, medium and high and what each one does, I recommend reading those fully and finding out if high is going to be too high for you.

If you need help,feel free to open a ticket to support, they will security check your server for you and they will advise you further.

Personally, keep it on high, see how you go with it.

Hope this helps.

[gohighvoltage]

Thanks James. I will look in the config to see how I can switch the SSH. Earlier today I had a port scanning attack, that was blocked from an ip that looked like a router IP, it was 192.168.75.4

[nayan007]

Hi James,

The link is very useful to me as I have an less idea about it.When I went through the link I found many information regarding port scanning

[gohighvoltage]

2:15am this morning, 35 port scanning attacks, all within minutes. All from different IP's. Really odd.

Here is some of them:

128.59.14.103 (US/United States/scanner-3.hacktory.cs.columbia.edu) blocked for port scanning

184.22.164.90 (US/United States/184-22-164-90.static.hostnoc.net) blocked for port scanning

199.47.225.20 (US/United States/199-47-225-20.dc74.com) blocked for port scanning

204.45.81.50 (US/United States/.) blocked for port scanning

204.12.214.170 (US/United States/-) blocked for port scanning

206.225.11.151 (US/United States/s151.710lc.hostirian.com) blocked for port scanning

208.64.66.196 (US/United States/-) blocked for port scanning

209.119.114.66 (US/United States/news.emgrow.com) blocked for port scanning

209.160.32.69 (US/United States/-) blocked for port scanning

209.190.11.202 (US/United States/ca.b.be.static.xlhost.com) blocked for port scanning

216.87.173.57 (US/United States/-) blocked for port scanning

216.144.252.58 (US/United States/58-252-144-216.static.reverse.lstn.net) blocked for port scanning

38.99.183.108 (US/United States/s-2663b76c.netrack1serv.com) blocked for port scanning

38.111.199.202 (US/United States/-) blocked for port scanning

50.23.16.34 (US/United States/50.23.16.34-static.reverse.softlayer.com) blocked for port scanning

64.120.251.106 (US/United States/64-120-251-106.static.hostnoc.net) blocked for port scanning

64.196.206.169 (US/United States/smtp.leroslimo.com) blocked for port scanning

64.235.56.22 (US/United States/lasvegas-nv-datacenter.com) blocked for port scanning

64.40.108.52 (CA/Canada/nn1868.van.ca.siteprotect.com) blocked for port scanning

65.36.36.140 (US/United States/65-36-36-140.static.grandenetworks.net) blocked for port scanning

65.50.224.42 (US/United States/-) blocked for port scanning

66.85.137.130 (US/United States/-) blocked for port scanning

66.199.234.170 (US/United States/66-199-234-170.reverse.ezzi.net) blocked for port scanning

67.219.60.132 (US/United States/-) blocked for port scanning

67.159.5.71 (US/United States/server.revendagospel.com.br) blocked for port scanning

69.163.33.146 (CA/Canada/69-163-34-146.in-addr.arpa.static.dsn1.net) blocked for port scanning

69.50.233.82 (US/United States/ss0373.swh.net) blocked for port scanning

128.59.14.103 (US/United States/scanner-3.hacktory.cs.columbia.edu) blocked for port scanning

72.55.133.154 (CA/Canada/-) blocked for port scanning

98.142.209.98 (US/United States/-) blocked for port scanning

208.90.24.53 (US/United States/s3.phone.5280networks.net

217.119.188.202 (FR/France/inv-202.188.119.217.fprt.com