Tag Info

New answers tagged

1

Your link goes down about 3 minutes after the "intrusion" has been detected. It's highly unlikely that the disconnect has been caused by one of these network packets. The packets look like regular scans (SYN packet to TCP port 22 - that's a classic, the other is a proxy scan - looking for squid at 3128), I have serious reservations that this is something ...


1

How to diagnose if you are under a brute scan or a targeted attack? If you have the possibility to do so, keep free a specific public @IP within your network. Register it correctly on the DNS as a typical name for a web server. But don't attribute this @IP to any real machine within your network. I mean don't go as far as to create a honey pot, just create ...


0

It is difficult to know whether you are being targeted specifically. It is very likely that you are getting hit with automated scans that can be ignored as long as you have configured your firewall to block all incoming traffic. Phishing attacks and outbound connections to malicious sites are much more serious as they are more likely to succeed. Here is a ...


5

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic: Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not ...



Top 50 recent answers are included