Port Scan Logs

Do you have 'Limit notifications' selected on the 'Global' tab of 'Management >> Notifications'?

I usually just forward the emailed notification to abuse address of the offender's ISP.

Cheers - Bob

I've recently been receiving portscan e-mail alerts from something called research.nmap.org?  It'll result in ~140 unique e-mails.  I have portscan protection enabled on my Sophos UTM 9.4 home box, but these are fairly frequent and annoying.  Sophos UTM 9.4 is set to drop traffic so it appears I'm being protected against whatever this is.

Is there any such thing as a legitimate portscan?  I can't find anything about this research.nmap.org.

Is it possible to continue to block these attempts while not alerting via e-mail about this specific IP?

A portscan was detected. Details about the event:

Time.............: 2016-08-13 05:21:46

Source IP address: 71.6.152.72 (research.nmap.org)

Hi Jason,

Go to Management > Notifications > Port Scan; uncheck the Email box.

Thanks

All of the things on the 'Intrusion Prevention' tabs are recorded in the Intrusion Prevention log.

Check out research.nmap.org - they do real-world tests of the respected nmap scanner.  It will probably be several years before they scan you again, but they're nothing to worry about.

Cheers - Bob