Strange Requests On Fedora Server

[milonic]

Hi Everybody,

This is my first post here so please let me know if I do anything wrong or post in wrong place etc :]

Anyways, I have a Fedora server [Fedora 8 I think] and once per week [it's random days but usually Monday or Tuesday] it makes some very strange requests to what appear to be search engines. My concern is that this box is fully firewalled both at the router and by way of IPTables so NOTHING should be getting in from the outside world. However, something is happening that I'm not happy about, I just can't seem to find it though.

I see quite a few requests from addresses like 72.30.186.25, 78.33.33.80, 209.202.254.14

Has anybody come across this before?

If not, what's the best way of finding out which process this is coming from?

Here's a copy of the logwatch report from yesterday:


--------------------- iptables firewall Begin ------------------------

Dropped 203 packets on interface eth0
From 0.0.0.0 - 11 packets
To 255.255.255.255 - 11 packets
Service: bootps [udp/67] [Dropwall:] - 11 packets
From 72.30.186.25 - 1 packet
To 192.168.0.2 - 1 packet
Service: 50801 [tcp/50801] [Dropwall:] - 1 packet
From 78.33.33.80 - 66 packets
To 192.168.0.2 - 66 packets
Service: 35582 [tcp/35582] [Dropwall:] - 1 packet
Service: 35699 [tcp/35699] [Dropwall:] - 1 packet
Service: 35725 [tcp/35725] [Dropwall:] - 1 packet
Service: 35738 [tcp/35738] [Dropwall:] - 1 packet
Service: 36303 [tcp/36303] [Dropwall:] - 1 packet
Service: 36328 [tcp/36328] [Dropwall:] - 1 packet
Service: 36339 [tcp/36339] [Dropwall:] - 1 packet
Service: 36348 [tcp/36348] [Dropwall:] - 1 packet
Service: 36379 [tcp/36379] [Dropwall:] - 1 packet
Service: 36394 [tcp/36394] [Dropwall:] - 1 packet
Service: 37739 [tcp/37739] [Dropwall:] - 1 packet
Service: 37750 [tcp/37750] [Dropwall:] - 1 packet
Service: 38311 [tcp/38311] [Dropwall:] - 1 packet
Service: 39509 [tcp/39509] [Dropwall:] - 1 packet
Service: 40781 [tcp/40781] [Dropwall:] - 1 packet
Service: 41202 [tcp/41202] [Dropwall:] - 1 packet
Service: 41333 [tcp/41333] [Dropwall:] - 1 packet
Service: 41344 [tcp/41344] [Dropwall:] - 1 packet
Service: 41959 [tcp/41959] [Dropwall:] - 1 packet
Service: 42543 [tcp/42543] [Dropwall:] - 1 packet
Service: 42596 [tcp/42596] [Dropwall:] - 1 packet
Service: 43607 [tcp/43607] [Dropwall:] - 1 packet
Service: 43616 [tcp/43616] [Dropwall:] - 1 packet
Service: 44095 [tcp/44095] [Dropwall:] - 1 packet
Service: 45173 [tcp/45173] [Dropwall:] - 1 packet
Service: 45186 [tcp/45186] [Dropwall:] - 1 packet
Service: 45199 [tcp/45199] [Dropwall:] - 1 packet
Service: 45621 [tcp/45621] [Dropwall:] - 1 packet
Service: 46362 [tcp/46362] [Dropwall:] - 1 packet
Service: 46472 [tcp/46472] [Dropwall:] - 1 packet
Service: 47334 [tcp/47334] [Dropwall:] - 1 packet
Service: 47503 [tcp/47503] [Dropwall:] - 1 packet
Service: 48562 [tcp/48562] [Dropwall:] - 1 packet
Service: 48571 [tcp/48571] [Dropwall:] - 1 packet
Service: 48580 [tcp/48580] [Dropwall:] - 1 packet
Service: 49525 [tcp/49525] [Dropwall:] - 1 packet
Service: 49534 [tcp/49534] [Dropwall:] - 1 packet
Service: 49543 [tcp/49543] [Dropwall:] - 1 packet
Service: 49824 [tcp/49824] [Dropwall:] - 1 packet
Service: 49837 [tcp/49837] [Dropwall:] - 1 packet
Service: 50194 [tcp/50194] [Dropwall:] - 1 packet
Service: 50205 [tcp/50205] [Dropwall:] - 1 packet
Service: 50214 [tcp/50214] [Dropwall:] - 1 packet
Service: 50495 [tcp/50495] [Dropwall:] - 1 packet
Service: 51165 [tcp/51165] [Dropwall:] - 1 packet
Service: 51174 [tcp/51174] [Dropwall:] - 1 packet
Service: 51277 [tcp/51277] [Dropwall:] - 1 packet
Service: 51286 [tcp/51286] [Dropwall:] - 1 packet
Service: 52340 [tcp/52340] [Dropwall:] - 1 packet
Service: 52351 [tcp/52351] [Dropwall:] - 1 packet
Service: 52654 [tcp/52654] [Dropwall:] - 1 packet
Service: 53248 [tcp/53248] [Dropwall:] - 1 packet
Service: 53257 [tcp/53257] [Dropwall:] - 1 packet
Service: 53266 [tcp/53266] [Dropwall:] - 1 packet
Service: 53455 [tcp/53455] [Dropwall:] - 1 packet
Service: 53784 [tcp/53784] [Dropwall:] - 1 packet
Service: 54812 [tcp/54812] [Dropwall:] - 1 packet
Service: 55131 [tcp/55131] [Dropwall:] - 1 packet
Service: 58342 [tcp/58342] [Dropwall:] - 1 packet
Service: 58351 [tcp/58351] [Dropwall:] - 1 packet
Service: 58389 [tcp/58389] [Dropwall:] - 1 packet
Service: 58711 [tcp/58711] [Dropwall:] - 1 packet
Service: 60859 [tcp/60859] [Dropwall:] - 1 packet
Service: 60870 [tcp/60870] [Dropwall:] - 1 packet
Service: 60879 [tcp/60879] [Dropwall:] - 1 packet
Service: 60935 [tcp/60935] [Dropwall:] - 1 packet
From 192.168.0.1 - 15 packets
To 255.255.255.255 - 15 packets
Service: bootpc [udp/68] [Dropwall:] - 15 packets
From 192.168.0.11 - 8 packets
To 255.255.255.255 - 8 packets
Service: bootps [udp/67] [Dropwall:] - 8 packets
From 192.168.0.21 - 4 packets
To 255.255.255.255 - 4 packets
Service: bootps [udp/67] [Dropwall:] - 4 packets
From 192.168.0.123 - 5 packets
To 224.0.0.251 - 5 packets
Service: mdns [udp/5353] [Dropwall:] - 5 packets
From 209.202.254.14 - 93 packets
To 192.168.0.2 - 93 packets
Service: 33497 [tcp/33497] [Dropwall:] - 1 packet
Service: 33498 [tcp/33498] [Dropwall:] - 1 packet
Service: 33544 [tcp/33544] [Dropwall:] - 1 packet
Service: 33554 [tcp/33554] [Dropwall:] - 1 packet
Service: 34457 [tcp/34457] [Dropwall:] - 1 packet
Service: 34625 [tcp/34625] [Dropwall:] - 1 packet
Service: 34636 [tcp/34636] [Dropwall:] - 1 packet
Service: 34637 [tcp/34637] [Dropwall:] - 1 packet
Service: 34759 [tcp/34759] [Dropwall:] - 1 packet
Service: 34768 [tcp/34768] [Dropwall:] - 1 packet
Service: 34871 [tcp/34871] [Dropwall:] - 1 packet
Service: 34872 [tcp/34872] [Dropwall:] - 1 packet
Service: 34897 [tcp/34897] [Dropwall:] - 1 packet
Service: 34906 [tcp/34906] [Dropwall:] - 1 packet
Service: 35444 [tcp/35444] [Dropwall:] - 1 packet
Service: 35445 [tcp/35445] [Dropwall:] - 1 packet
Service: 36131 [tcp/36131] [Dropwall:] - 1 packet
Service: 36142 [tcp/36142] [Dropwall:] - 1 packet
Service: 36143 [tcp/36143] [Dropwall:] - 1 packet
Service: 36151 [tcp/36151] [Dropwall:] - 1 packet
Service: 37180 [tcp/37180] [Dropwall:] - 1 packet
Service: 37181 [tcp/37181] [Dropwall:] - 1 packet
Service: 37189 [tcp/37189] [Dropwall:] - 1 packet
Service: 38344 [tcp/38344] [Dropwall:] - 1 packet
Service: 38355 [tcp/38355] [Dropwall:] - 1 packet
Service: 38356 [tcp/38356] [Dropwall:] - 1 packet
Service: 39442 [tcp/39442] [Dropwall:] - 1 packet
Service: 39451 [tcp/39451] [Dropwall:] - 1 packet
Service: 39452 [tcp/39452] [Dropwall:] - 1 packet
Service: 40341 [tcp/40341] [Dropwall:] - 1 packet
Service: 40352 [tcp/40352] [Dropwall:] - 1 packet
Service: 40355 [tcp/40355] [Dropwall:] - 1 packet
Service: 40363 [tcp/40363] [Dropwall:] - 1 packet
Service: 40475 [tcp/40475] [Dropwall:] - 1 packet
Service: 40485 [tcp/40485] [Dropwall:] - 1 packet
Service: 40493 [tcp/40493] [Dropwall:] - 1 packet
Service: 40572 [tcp/40572] [Dropwall:] - 1 packet
Service: 40584 [tcp/40584] [Dropwall:] - 1 packet
Service: 40627 [tcp/40627] [Dropwall:] - 1 packet
Service: 40636 [tcp/40636] [Dropwall:] - 1 packet
Service: 41106 [tcp/41106] [Dropwall:] - 1 packet
Service: 41230 [tcp/41230] [Dropwall:] - 1 packet
Service: 42512 [tcp/42512] [Dropwall:] - 1 packet
Service: 44544 [tcp/44544] [Dropwall:] - 1 packet
Service: 45470 [tcp/45470] [Dropwall:] - 1 packet
Service: 45500 [tcp/45500] [Dropwall:] - 1 packet
Service: 45511 [tcp/45511] [Dropwall:] - 1 packet
Service: 46959 [tcp/46959] [Dropwall:] - 1 packet
Service: 46960 [tcp/46960] [Dropwall:] - 1 packet
Service: 48285 [tcp/48285] [Dropwall:] - 1 packet
Service: 48295 [tcp/48295] [Dropwall:] - 1 packet
Service: 49025 [tcp/49025] [Dropwall:] - 1 packet
Service: 49026 [tcp/49026] [Dropwall:] - 1 packet
Service: 49835 [tcp/49835] [Dropwall:] - 1 packet
Service: 49846 [tcp/49846] [Dropwall:] - 1 packet
Service: 49983 [tcp/49983] [Dropwall:] - 1 packet
Service: 50001 [tcp/50001] [Dropwall:] - 1 packet
Service: 50734 [tcp/50734] [Dropwall:] - 1 packet
Service: 50754 [tcp/50754] [Dropwall:] - 1 packet
Service: 50766 [tcp/50766] [Dropwall:] - 1 packet
Service: 50767 [tcp/50767] [Dropwall:] - 1 packet
Service: 51015 [tcp/51015] [Dropwall:] - 1 packet
Service: 51023 [tcp/51023] [Dropwall:] - 1 packet
Service: 51676 [tcp/51676] [Dropwall:] - 1 packet
Service: 52390 [tcp/52390] [Dropwall:] - 1 packet
Service: 52413 [tcp/52413] [Dropwall:] - 1 packet
Service: 52425 [tcp/52425] [Dropwall:] - 1 packet
Service: 53709 [tcp/53709] [Dropwall:] - 1 packet
Service: 53720 [tcp/53720] [Dropwall:] - 1 packet
Service: 53735 [tcp/53735] [Dropwall:] - 1 packet
Service: 53736 [tcp/53736] [Dropwall:] - 1 packet
Service: 54110 [tcp/54110] [Dropwall:] - 1 packet
Service: 55000 [tcp/55000] [Dropwall:] - 1 packet
Service: 55001 [tcp/55001] [Dropwall:] - 1 packet
Service: 55009 [tcp/55009] [Dropwall:] - 1 packet
Service: 55010 [tcp/55010] [Dropwall:] - 1 packet
Service: 55024 [tcp/55024] [Dropwall:] - 1 packet
Service: 55025 [tcp/55025] [Dropwall:] - 1 packet
Service: 55637 [tcp/55637] [Dropwall:] - 1 packet
Service: 55650 [tcp/55650] [Dropwall:] - 1 packet
Service: 56544 [tcp/56544] [Dropwall:] - 1 packet
Service: 56553 [tcp/56553] [Dropwall:] - 1 packet
Service: 56554 [tcp/56554] [Dropwall:] - 1 packet
Service: 57576 [tcp/57576] [Dropwall:] - 1 packet
Service: 57577 [tcp/57577] [Dropwall:] - 1 packet
Service: 57589 [tcp/57589] [Dropwall:] - 1 packet
Service: 58177 [tcp/58177] [Dropwall:] - 1 packet
Service: 58675 [tcp/58675] [Dropwall:] - 1 packet
Service: 59934 [tcp/59934] [Dropwall:] - 1 packet
Service: 59935 [tcp/59935] [Dropwall:] - 1 packet
Service: 59949 [tcp/59949] [Dropwall:] - 1 packet
Service: 59950 [tcp/59950] [Dropwall:] - 1 packet
Service: 60297 [tcp/60297] [Dropwall:] - 1 packet

---------------------- iptables firewall End -------------------------

Looking forward to any replies,
-- Andy

[RobinVossen]

It looks like a Portscan?
However those domains are pretty "harmless".

What kind of server is it?
I don't suspect a compromise to be honest.