CentOS webserver with CSF (Config Server Firewall) running. Blocking all outbound / Inbound traffic except listed ports 80 81 22 21 etc. for web, mail & FTP services etc.
I'm use to seeing heaps of Inbound blocks from hackers etc. but seeing the below outbound block & appreciate suggestions on where to look to try & discover what is causing this traffic.
Sep 26 12:40:28 thor kernel: Firewall: *TCP_OUT Blocked* IN= OUT=eth0 SRC=xx.xx.xx.xx DST=18.104.22.168 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=54974 DF PROTO=TCP SPT=49907 DPT=31000 WINDOW=14600 RES=0x00 SYN URGP=0 UID=509 GID=509
My server XX is the SRC source IP & destination IP seems to belong to Amazon web services.
The UID GID listed in log is that of user with hosted website but cant see anything obvious in site. I presume there must be some kind of script trying to contact AWS.