Seeing a 'filtered' state for a port has nothing to do with a "ping" or an exploitation attempt. Nmap's traffic is generally not exploitative. An adaptive firewall could detect the default (with privileges) half-open SYN scan after it has detected an open port, or it could detect any of it scan types based on the number of closed ports it tries to connect to. But most firewalls will not do this.
--reason option, you can see the type of response that caused a port to be in the state it is. Most of the time, 'filtered' means that all the probes to that port timed out, and no response was seen. Sometimes, though, it can be because an ICMP Administratively Prohibited message was received. This is a good indication that a more-intelligent firewall is in place.
In the most common case, however, a filtered port simply means that a static (i.e. not adaptive) firewall has been configured to drop connections to that port. In this case, any incoming connection, whether Nmap or telnet or a browser, will be dropped.