Nobody Port Scanning Process - Help

1 post Page 1 of 1
CuroHostingLTD
Junior Member
Posts: 1
Joined: 16 May 2018, 11:25


Hey,

I wonder if someone can help me with something please :)....

We are getting notifications every minute or so from LFD telling us there is a "Tracking Hit" with the process "Nobody".

I understand that "Nobody" is either not connected to a user or it is coming from the server itself. When I block the DST in the firewall it tells me it is already blocked yet we still get the emails. Why would this notification be needed if the IP is already blocked?

What is actually happening here? I think the "Port Tracking" is something scanning for open ports but I get the same amount of hits every time, and the same results.

I read somewhere that it could be a failed software installation doing this.

I have killed all "Nobody" processes to try and kill anything that is looping internally that is broken but that didn't work either. I also restarted LFD + CSF and no luck there either.

Can someone let me know how to fix this issue? Or let me know if this isn't actually an issue but if not, please how do I disable only these "Port Tracking" notifications from this IP or this UID so I can get my emails back to normal function.

Kind Regards

Jamie

Image for Reference: https://www.curohosting.com/nobodyProcess.png
1 post Page 1 of 1