Port Scanning

[VAS]

Hi all, I have my VPS up and running with csf firewall and all seems to be well.

Thing is, I get port scanning and brute force attempt notifications several times a day. They get blocked so I assume it's not a big deal (unless I'm way off on that one).

It has me wondering, does anyone else experience attempts on your VPS with such regularity? Is this "normal"?

Thanks to anyone who can share their own experience with this!

[quietFinn]

Yes it is normal.

[aeons]

I get it alot. If you tweak your CSF settings you can have CSF only bother you about constant attackers and not those that just knock and leave.

If you have the time, just report it to the ISP and you might find the scans lessen for a few days. At least, I do, anyway.

Go to whois.domaintools.com and enter the IP address.
Once you enter it you should see a page with abuse contacts
Send a copy of your CSF alert to the abuse contact and let them know a customer of theirs might be up to no good.

More often than not, the port scan notices are the result of a compromised machine. (Hacked machines looking for other machines to hack, etc etc)

[VAS]

Thank you so much for your answers!