Portscan?

floris · 07-03-2002, 12:18 PM

Hello,

I just purchased FlashFXP and received the key in the e-mail. Everything is 100% fine. What I was wondering about. From the system where we purchased it, we received a portscan from (dns) - 209.126.172.165 (flashfxp.com). First slowly around 1080 then a complete sweep. Our netstat showed this. When we wanted to log it, the connections already timed out. We wrote the IP down and did a nslookup on our server. Why did our system get a portscan? I think this isn't really nice and I didn't read anywhere that this would be done upon purchase, and I also see no reason for this. I hope to get an explanation soon.

Kind regards,

ps
The purchase went great, simple and clean. Everything was done within a few hours and I am using it to upload and download the files from my web servers. Syncking them with site2site seems to be going very good.

bigstar · 07-03-2002, 01:55 PM

I honestly don't know. I can't explain a port scan or any incoming connections from flashfxp.com or any of our other servers.

When you enter your registration key in FlashFXP it perfoms an automatic Live Update (out going connection to port 80 on one of our servers). Other than that there should be no other attempts to contact our servers and our servers should NEVER attempt an incoming connection.

Linkster · 07-03-2002, 02:03 PM

that is very unusal indeed. we have no reason to do anything like this, and you are the first to report something. FlashFXP.com is on a shared server, but it has a dedicated ip. I will definitely check to see if there is a rogue process running on our server. Can you reproduce this? If so, please log it, and send us the results. This is very disturbing, and we'd like to get to the bottom of it as soon as possible. The only other thing i can think of is that someone is doing something and spoofing from our server...

floris · 07-03-2002, 03:48 PM

Quote:

Originally posted by bigstar
I honestly don't know. I can't explain a port scan or any incoming connections from flashfxp.com or any of our other servers.

When you enter your registration key in FlashFXP it perfoms an automatic Live Update (out going connection to port 80 on one of our servers). Other than that there should be no other attempts to contact our servers and our servers should NEVER attempt an incoming connection.

It is nice to hear that it shouldn't have happened.
I understand it does make a connection when entering the license information. But this is done on my system at my home here, and not on the other system, which we used to purchase it.

We will try and have a more detailed look at possible logs and will inform with future occurances. If I remember correctly it occured around 15:30 GMT+1

floris · 07-04-2002, 03:37 AM

Quote:

Originally posted by Linkster
that is very unusal indeed. we have no reason to do anything like this, and you are the first to report something. FlashFXP.com is on a shared server, but it has a dedicated ip. I will definitely check to see if there is a rogue process running on our server. Can you reproduce this? If so, please log it, and send us the results. This is very disturbing, and we'd like to get to the bottom of it as soon as possible. The only other thing i can think of is that someone is doing something and spoofing from our server...

Spoofed? I doubt it. Especially since it was around the time of purchase.