Xiaomi phones trying to acces port 80 of the firewall

[josepgb]

Hi,

Anyone has observed these phones trying to access port 80 of the firewall (which I have blocked in the camping customers subnet along port 22)?

I have checked and they are mostly redmi 9. Is this a legitimate connection or they are trying to break the firewall with some malware?

Before I blocked them they killed my nginx.

Tks!!

[stephenw10]

Almost certainly just poorly configured by default rather than anything malicious. Any real attack or scan would be across a range of ports/services and wouldn't waste time hitting the same port repeatedly.

If you change the rule to reject instead of block they might get the message and stop trying.

Steve