Is this an intrusion on my server?

Portal Home > Knowledgebase > Articles Database > Is this an intrusion on my server?

Posted by Earthblaze, 11-02-2014, 10:51 AM
I noted this morning on Config Server Firewall IP logs that my server has been attempting to access Microsoft Hotmail and Bingbot mail servers every few seconds since last night. My server has used different random ports trying to connect to port 25 on the remote server. I have all nut a few ports blocked inbound and outbound so all these connections attempts failed. I immediately block outward connections on Port 25 as a precaution. I run clamav, chkrootkit,rootkit hunter and linux malware detect every day. I did full manual scans this morning and everything was negative. SSH and Virtualmin are on non-standard ports and can only be accessed from the UK. There have been no-logins ion the postfix log. Anyone have ideas? I would be very grateful. Regards, Earthblaze Attached Thumbnails
Posted by Webblog, 11-02-2014, 11:44 AM
yes this happens ALL the time. I used to get so many failed login attempts to my server so I used WHM to block ALL IPs except for mine
Posted by Earthblaze, 11-02-2014, 03:18 PM
Hi, I don't have a static IP at home so cannot whitelist my IP (well I can but as it changes 5-6 times a day (ongoing problem) it would be impractical. I also noted on my IP logs that Google was attempting to connect to webmin (hidden port). Not sure if it was a proxy server.