Port Scan Source

Problem description

This IP has been identified to scan the Internet for potential attack targets. Your device is connecting to other networks and devices in the Internet and scanning them for open ports. Usually this means that someone is controlling a device in your network and using it to find other vulnerable devices. Your device is being used to actively find new victims to infect or attack.

These kinds of port scans are detected automatically by our research partner Telia Darknet. They operate a service that identifies IP addresses which are making port scans for their unused IP address space.

Suggestions for repair

First of all you need to identify the device in your network which is making these port scans. Please read our instructions on locating vulnerable devices.

After you find the correct device, we recommend you to reset it to its factory settings or perform a full reinstall of the operating system. If your device is compromised and actively sending out attacks, it is usually too complex to try to clean the system without a full reset.

After you reset the device or reinstall the operating system, you should install all of the latest software updates to make sure your system will not be compromised in the same way again. If no security updates are available, you might consider switching to a different device, which is updated against known vulnerabilities.