usg60 Top HTTP Web Site Hits curious entries

thecoppa · May 2019

On my USG60 I activated the daily reports. One of the sections is entitled Top HTTP Web Site Hits and it is for my WAN interface. The first few entries make sense, the dns name and also the IP address of my web server show an expected number of hits.further down the list is seems there are a few "web site hits" for addresses not in my USG. Should I be concerned? Below is a sanitized copy of the report I'm referring to.

1	mywebsite.ddns.net	7542
2	my ip address	5922
3	my ip address:80	582
4	my carriers dns	292
5	112.124.42.80:63435	4
6	127.0.0.1	3
7	5.188.210.101	3
8	80	3
9	api.huobi.pro	2
10	outlawservers.com	1

Should this at all concern me? I'm not sure why this would be happening. They seem to be on the report every day with the same number of hits.

#Biz_May_2019

CHS · May 2019

Hi @thecoppa

The "Top HTTP Web Site Hits" should be the top HTTP website has "forwarded" by your WAN interface.
If you have any concern of it, you can capture the packets on WAN interface.
Then it should help to find what's the source IP try to connecting to your server.

Maintenance >> Diagnostics >> Packet Capture >> Select interface and set the host IP and then click capture button.

CHS · May 2019

Hi @thecoppa

The "Top HTTP Web Site Hits" should be the top HTTP website has "forwarded" by your WAN interface.
If you have any concern of it, you can capture the packets on WAN interface.
Then it should help to find what's the source IP try to connecting to your server.

Maintenance >> Diagnostics >> Packet Capture >> Select interface and set the host IP and then click capture button.

usg60 Top HTTP Web Site Hits curious entries

Accepted Solution

All Replies

Categories

Security Highlight

Security Help Center