Hi!

It seems very unlikely that anyone would do a port scan from the wikimedia servers. I would guess it's someone spoofing the source IP address, although I can't see much point in that beyond causing an annoyance (which is more than enough reason for some people).

Of the usual cause is simply firewall gone nuts (it is the usual case in such situations). I'd suggest ditching the firewall, unless one can really understand what it does and all it's bugs.

And that report looks like simple reading of Wikipedia was trapped as an attack. Way to go.

BR,