Turns out this is port scan from Gryphon. I disabled SSH port un UNRAID management tab since I don't use ssh.
From Gryphon support:
"Our Gryphon has a firewall that will block/filter inbound traffic. the Gryphon regularly scans ports that are open and will give you a notification for an open port. You will then determine if that port is used by an application or website and is safe to leave as open.
Here are some options you can choose for a port scan detection result.
1. Quarantine - can’t access the internet on the rogue device (stops the device)
2. Monitor – to monitor the device and keep you posted.
3. Delete – delete the notification but will notify again when there is another scan
4. Ignore - will NOT notify the user for 7 days
The quarantine will have your device totally blocked.
Thank you,
Gryphon Support/FE
Customer Support Line +1 (480) 428-4016"
