This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Portscan detected from 8.8.4.4 (dns.google)

I received today Portscan detected from 8.8.4.4 (dns.google). Has anyone seen this before? I am using google servers as dns forwarders. Thank you, Martin

This thread was automatically locked due to age.

0 Alexander Busch over 3 years ago

Got that some times ago, see https://community.sophos.com/products/unified-threat-management/f/german-forum/62491/portscan-detected-google-dns in the German part unfortunately.

A guess from Bob was a spoofed IP. I never had a 100% explanation.

Best regards

Alex

-
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 3 years ago in reply to Alexander Busch

I've learned since then, Alex, that this also can be a DDoS attack where the sending IP is spoofed by devices on a bot net.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 martin_sh over 3 years ago in reply to BAlfson

Thank you Alex and Bob for your input and help! I have created a "black hole" and I add to the list all portscan received. I noticed most of received portscans (90%) are coming from ec2 compute amazonaws (i.e., ec2-34-229-43-227.compute-1.amazonaws.com). I understand, this is a hosted service where people create their own vm servers. Please correct if I am wrong because I also use Echo devices at home.
Cancel
Vote Up 0 Vote Down

Cancel