| Posted by sherwood, 04-18-2009, 05:10 PM | | hello,
I have been receiving a lot of emails from LFD about this ip (93.190.138.129) port scanning.
I get about 3+ of these emails a day letting me know that ldf has blocked the ip temporary.
I am now wondering should I be worried about this ip port scanning?
The ip is from the netherlands where my server is hosted and was wondering if its a coincidence or not?
|
| Posted by LoganNZ, 04-18-2009, 05:46 PM | | I wouldn't worry about it, just a bot scanning your IP range.
|
| Posted by Servosupport, 04-18-2009, 05:57 PM | | check out for your firewall is up to date, you can use apf as well as BFD to secure the server..
|
| Posted by oliviakitty, 04-18-2009, 06:03 PM | | I get a lot of those port scanning alert emails as well.
I switched it from temporary ban to permanent ban, but then it blocked pingdom from checking my uptime.
|
| Posted by LoganNZ, 04-18-2009, 06:20 PM | | Assuming he has LFD - CSF is installed and running - no need for APF.
|
| Posted by dkitchen, 04-18-2009, 08:54 PM | | Block the IP and move on.
|
| Posted by sherwood, 04-19-2009, 05:51 AM | | Yeah I got CSF and LFD.
Also I emailed my datacenter as the server that was port scanning my server was coming from the same datacenter I am with.
and yeah I have blocked it now permanently
thanks all
|
| Posted by kenbiz, 04-19-2009, 07:12 AM | | You may have to set the rules in your CSF firewall system to either banned the IP from being port scanning or for temporary.
|
| Posted by ServerManagement, 04-19-2009, 08:28 AM | | This is very common, just block the ip and see what happens. If you get more from the same ip range then you may want to block the entire ip range.
|
| Posted by sherwood, 04-19-2009, 08:30 AM | | The thing is though my server's ip is in the same range as the ip thats port scanning me.
If i banned the whole range would that not cause a lot of problems with my server?
|
| Posted by txitcs, 04-19-2009, 09:26 AM | | No, your server reads itself as 127.0.0.1. And if you have additional servers in the DC you can just add them to csf.ignore and csf.allow
But being that the server is in your same DC, I'd contact your host about it.
|
| Posted by sherwood, 04-19-2009, 09:56 AM | | Ah okay thanks,
Also I sent an email to them last night asking about it but still no reply.
Hopefuly there will be a reply soon tho.
|
|
 Add to Favourites
 Print this Article
|
