The existing answer is correct in its technical analysis of the firewall log entry, but it's missing one point that makes the conclusion incorrect. The packet
- Is a
RST (reset) packet
- to your host at
- from his port
- to your port
- and has been
BLOCKed by UFW.
Port 25 (the source port) is commonly used for email. Port 50616 is in the ephemeral port range, meaning there's no consistent user for this port. A TCP "reset" packet can be sent in response to a number of unexpected situations, such as data arriving after a connection has been closed, or data being sent without first establishing a connection.
220.127.116.11 reverse-resolves to
cxr.mx.a.cloudfilter.net, a domain used by the CloudMark email filtering service.
Your computer, or someone pretending to be your computer, is sending data to one of CloudMark's servers. The data is arriving unexpectedly, and the server is responding with a
RST to ask the sending computer to stop. Given that the firewall is dropping the
RST rather than passing it through to some application, the data that's causing the
RST to be sent isn't coming from your computer. Instead, you're probably seeing backscatter from a denial-of-service attack, where the attacker is sending out floods of packets with forged "from" addresses in an attempt to knock CloudMark's mail servers offline (perhaps to make spamming more effective).