scansnarf-ng detected Portscan

scansnarf-ng detected an outgoing Portscan, with the SRC-PORT 3478 and the DST-PORT 1033 (UDP, SIZE 146), with 600 packages within a few seconds (18:15:40 to 18:15:46).

On that port a coturn was running. What could have caused that behavior? Was it a (security-)bug in coturn? Was it normal behavior and scansnarf simply misjudged what it is? Was coturn misconfigured (e.g. weak static auth secret)? (Sorry for opening the issue if it was the latter two.)

/etc/turnserver.conf

```
listening-port=3478
fingerprint
lt-cred-mech
use-auth-secret
static-auth-secret=... (weak static secret)
realm=stun. ...
no-loopback-peers
no-multicast-peers

keep-address-family
no-cli
no-tlsv1
no-tlsv1_1
no-loopback-peers
no-multicast-peers
denied-peer-ip=... (with several long lists)
```

I used coturn from Debian/Devuan stable with version 4.6.1-1

Start with /etc/turnserver.conf and the reported coturn 4.6.1-1 setup. Trace the UDP traffic around ports 3478 and 1033, then determine whether it is expected coturn behavior, a misconfiguration, or a security defect. Done means documenting the cause and any concrete configuration or version change required.

Written by the indexing model from the issue text.