Investigating Port Scanning Activity in My Home Lab

Over the past few days I noticed an unusual spike in port scanning activity against my home lab infrastructure. Instead of simply blocking the IP addresses, I decided to treat it as a small incident response exercise and investigate what was actually happening. Investigation My stack consists of: • OPNsense Firewall • CrowdSec • Nginx Proxy Manager • DMZ network • Reverse proxy for public services CrowdSec detected dozens of multi-port scanning attempts coming from multiple autonomous systems. During the investigation I: ✅ Correlated CrowdSec alerts with firewall logs ✅ Identified repeated scanning campaigns originating from the same infrastructure providers ✅ Compared alert history across several days to determine whether the same IPs were returning ✅ Verified whether the scanners actually reached my DMZ services ✅ Correlated reverse proxy access logs with CrowdSec detections One particularly interesting observation was a large number of scanners belonging to Modat B.V., a cyber threat intelligence company that continuously scans Internet-facing infrastructure. Their scanners identify themselves with the User-Agent: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/) The investigation showed that: • Most scanners were stopped at the firewall • Only a few HTTP requests reached the reverse proxy • The requests were limited to simple GET requests against the root page • No evidence of exploitation attempts or lateral movement was found Response Based on the investigation I decided to strengthen my defensive posture: 🔹 Increased CrowdSec ban duration from 7 days to 180 days 🔹 Started tracking repeated scanning campaigns over time 🔹 Built correlation between firewall logs and reverse proxy logs 🔹 Added additional monitoring for reconnaissance activity Takeaway This wasn’t about “being hacked.” It was about understanding the difference between: • Internet-wide reconnaissance • Legitimate Internet scanning • Automated threat intelligence collection • Potential malicious reconnaissance For me, the most valuable part was not blocking the traffic—it was learning how to investigate it properly, correlate multiple log sources, and make decisions based on evidence instead of assumptions. Cybersecurity is not only about prevention. It’s about visibility, investigation, and understanding what your infrastructure is actually telling you. #CyberSecurity #BlueTeam #ThreatHunting #IncidentResponse #CrowdSec #OPNsense #NginxProxyManager #Homelab #NetworkSecurity #SOC #DFIR #Linux

Photos