Lenovo systems keep triggering honeypots

[neufuse Veteran]

So I have honeypots set up on every subnet on my network, and I have noticed that ever since I set them up my two lenovo laptops keep trying to talk to them on port 80.

 

Does anyone know of any software Lenovo Flex or Yogo laptops would have installed by default that would scan your network on port 80? I did a complete system restore for factory state and it started right back up again.

 

Out of the 45 devices on my network, these two laptops are the only ones that have triggered the honeypots.

 

Bad thing is I have no real detail besides what system did it, what time and what port, no detail on any requests they might of attempted just that they tried to talk on port 80.

 

each system seems to do it about once every 2-3hrs when they are on the network

[goretsky Supervisor]

Hello,

 

Perhaps a packet capture at both origin and destination to see if you can correlate traffic?  Another option might be to run an interactive software firewall on the Lenovo laptops and see if you can get it to generate a prompt for the application requesting access?

 

Regards,

 

Aryeh Goretsky