port scanning LDF results

[optrex]

I've got a long list of IP's that have been trying to port scan but have been blocked by LFD. I've upped the block time from 20 mins to 24 hours, but I am still getting attempted scans and its been like this for a few weeks now.

Any ideas how I can provent them? Is it worth using a permanent block as they use random IP addresses?

[Administrator]

We will need to check what is inviting them to carry on the scanning attempts. You can open a ticket for our support staff and provide me with a ticket number.

I will ask one of our senior technical person to answer it asap.

[optrex]

Thanks - call ref #LPW-12695-683

[Administrator]

Alan has managed to find a script running on your VPS which is responsible for this problem. He will take necessary steps and respond to your ticket.

[optrex]

I've got the logs on the one that he identified already. Its fine I just haven't got round to putting it in the exclusion list for LFD. He's also disabled exec, but I ned that operative for several scripts that run on the server. I've updated the ticket.