4 ms·
The past year I upgraded my firewall and exposed a plex port. My new firewall gives me notifications and automatically blocks connections to the plex server bas
by wil421 4y ago
The past year I upgraded my firewall and exposed a plex port. My new firewall gives me notifications and automatically blocks connections to the plex server based on common signatures it knows about. None of my plex users complain or have issues.
A couple provides I sent abuse complaints to based on whois lookups responded with automated emails requesting the info in X-ARF format. It’s hard to get some cloud providers to respond to a random residential user.
A couple IPs were repeated “scans” by supposed security researchers with IPs out of Hawaii and France.
- radicaldreamer 4y agoIntelligence agencies
- wil421 4y agoGreat, you've made me revisit my list of IPs and accidentally type one in my address bar. Whois says it's Palo Alto IP 205.210.31.169 and they hit me back within 60 seconds on port 60001. It is annoying they are trying to scan for vulns, but I will likely block all the ranges I can find. If I find the sketchy Hawaii and French IPs I will post something. Edit: Here you go: https://academyforinternetresearch.org https://academyforinternetresearch.org IP Location United States United States Honolulu Academy Of Internet Research Limited Liability Company ASN United States AS400161 (registered Oct 22, 2021) Whois Server whois.arin.net IP Address 104.156.155.3 NetRange: 104.156.155.0 - 104.156.155.255 CIDR: 104.156.155.0/24 NetName: ACDRESEARCH NetHandle: NET-104-156-155-0-1 Parent: NET104 (NET-104-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Academy of Internet Research Limited Liability Company (AIRLL) RegDate: 2022-01-07 Updated: 2022-01-07 Ref: https://rdap.arin.net/registry/ip/104.156.155.0 OrgName: Academy of Internet Research Limited Liability Company OrgId: AIRLL Address: #A1- 5436 Address: 1110 Nuuanu Ave City: Honolulu StateProv: HI PostalCode: 96817 Country: US RegDate: 2021-10-15 Updated: 2022-11-06 Ref: https://rdap.arin.net/registry/entity/AIRLL
- thomasjudge 4y agoAnyone know if these guys are legit?
- wil421 4y agoThe page is literally nothing but a few basic HTML tags. If I had an email to burn I would message them. It seems they are running on Hivelocity a bare metal hosting provider.
- deleted 4y ago[deleted]
- arjvik 4y agoWhat firewall do you use? I'd love to be able to automatically block bots immediately!
- wil421 4y agoThe Unifi Dream Machine Special Edition is what I use. I do not have any degradation with my gigabit internet unlike past Unifi products I have owned. Snort is something I have looked at installing and playing with on a PFSense box. https://www.snort.org https://www.snort.org
- achillean 4y agoIf the bot is running from a cloud instance then you can fairly easily block it using something like Zeek. For example: https://help.shodan.io/zeek-integration/4-blocking https://help.shodan.io/zeek-integration/4-blocking You could also check if the remote IP has any open ports (ex. SSH) and block based on that as most regular visitors probably won't be exposing those types of services to the Internet.
- walrus01 4y agoIf you are auto-generating outbound SMTP traffic with abuse complaints from a fully automated script, sent to the ARIN/RIPE/APNIC/LACNIC/AFRINIC POC email addresses of IP space holders because something portscanned your firewall, you are part of the problem, not the solution. If I had a dollar for every person who has turned loose such a tool to shit up my abuse@ispname.com inbox...
- autoexec 4y agoIf you're getting reports of port scanning from the same IPs over and over, they're probably bots and I'd think most ISPs would want to know. The automated emails are usually in the same formats making them easy to filter and parse too.
- wil421 4y agoThat’s an interesting idea to automate my complaints. I seriously doubt the Las Vegas “located” IP with Hong Kong addresses on their registration or Shanghai UCloud Information Technology Company IPs are scanning me for good reasons. What do you think would happen if I run an older version of plex with a known vulnerability?
- Eisenstein 4y agoI mean, isn't that what shodan is for? Who would bother port scanning for that stuff?
- red-iron-pine 4y agoShodan is public. Chinese intelligence wants their version to be more detailed and not public.