Network Protection stats

I think that the host/IP names with the "PC" icon are clients on your LAN, and the UTM is using the host names of them in the reporting. And the domains/IP with the country flags are incoming packets from the internet that are being dropped.

A reverse DNS lookup of startedtop.com reveals nothing.

"Host startedtop.com not found: 3(NXDOMAIN)"

Hello Kevin,

I am reading this on my homelab like this:

So these are "Dropped Source Hosts" , if I am interested in line 3 for instance, then I click on that button in the upper right as shown in my screenshot above. You are then presented the GUI-View of the logs:

You can click on that row of interest and get a new detail view:

Obviously somebody is scanning the outside of my firewall from an aws instance. Research completed. This happens a hundred maybe a thousand times a day and that's what a firewall is for: to drop them.

Our company friewalls are often hit by recyber.net like yours, you can go there and opt-out from their research project, if you don't like that.

The rest is your internal clients, you could go into "dropped destination services" to find out  what is happening here and then try to shut down the root cause of these requests. Otherwise you just have to live with the number of these drops.

For me I would like to know, when some internal clients have more than a thousand drops a day and would investigate this. Maybe something is misconfigured or simply unneeded.

That is OK for hosts that have a resolvable IP address, but what about the domain name like "startedtop.com" that is unresolvable by DNS lookup, and doesn't appear anywhere in the logs.

You mentioned recyber.net as an example. I myself have scoured my logs and there is no log that mentions that specific domain anywhere.

A DNS lookup in Support>Tools>DNS Lookup returns not found.

Trying "recyber.\173net"

Host recyber.\xADnet not found: 3(NXDOMAIN)

When doing the DNS lookup from the web it did find the IP:

I have scanned my firewall logs for both of these IP addresses (104.21.18.133, 172.67.181.221) which is a  result of a DNS lookup for the domain recyber.net, but not one entry shows up. My point is that it's hard to diagnose what the source IP of these blocked packets are or the exact time it was logged. The original posted wanted to know the source of startedtop.com, but it remains a mystery as it appears the UTM does not log it, yet it appears as a dropped source host?

That is OK for hosts that have a resolvable IP address, but what about the domain name like "startedtop.com" that is unresolvable by DNS lookup, and doesn't appear anywhere in the logs.

You mentioned recyber.net as an example. I myself have scoured my logs and there is no log that mentions that specific domain anywhere.

A DNS lookup in Support>Tools>DNS Lookup returns not found.

Trying "recyber.\173net"

Host recyber.\xADnet not found: 3(NXDOMAIN)

When doing the DNS lookup from the web it did find the IP:

I have scanned my firewall logs for both of these IP addresses (104.21.18.133, 172.67.181.221) which is a  result of a DNS lookup for the domain recyber.net, but not one entry shows up. My point is that it's hard to diagnose what the source IP of these blocked packets are or the exact time it was logged. The original posted wanted to know the source of startedtop.com, but it remains a mystery as it appears the UTM does not log it, yet it appears as a dropped source host?