Recently we've noticed that AVAST has a feature called "Wi-Fi Inspector" that does network scanning and you may have received a few alerts from user machines running AVAST with this feature enabled.
Alerts that may identify this on your Console :
The "Port Scan" alerts usually have the same 5 ports as displayed below, however, we have seen a few variations that may include a couple different ports.
The "HTTP Proxy Request" alert always displays the same information on the attempt.
If you are seeing similar activity (as per the below alerts) on your Canary from a user machine running AVAST it may be worth checking and disabling the "Wi-Fi Inspector" feature in AVAST.
You can disable the feature by opening Avast, go to Menu --> Preferences --> Wi-Fi Inspector tab :
