4 ms·
Just for a different perspective, here in the EU I get most of the attacks from US servers. Often times Google cloud or AWS. But we can't block the IP space of
by geek_at 4y ago
Just for a different perspective, here in the EU I get most of the attacks from US servers. Often times Google cloud or AWS.
But we can't block the IP space of the US for obvious reasons
- tikkabhuna 4y agoDid you report it to Google/AWS? I feel like they would be proactive about removing malicious users, but whether expectations match reality is another question.
- batter 4y agoI did to Azure and Cloudflare. 0 responses. No one cares.
- tikkabhuna 4y agoDisappointing! Thanks for the reply.
- traceroute66 4y ago> I get most of the attacks from US servers. Often times Google cloud or AWS. Yup. The block $insert_country IP range "solution" is an outdated mentality that should have died off in the 90's. These days most attacks originate from US/Western cloud and other rent-a-box providers. They are a gift to attackers because they can hop around at the click of the button and they know the victims can't block the IP ranges because they're managed by US/Western organisations. DDOS attacks tend to happen on a Command and Control basis, and again, good luck blocking US/Western ISP IP ranges because their customers won't be able to visit your website. I have long given up on reporting to Google, AWS and others because nothing gets done, most of the time you get an automated message saying they just forward your Abuse report to the customer ... gee, thanks guys.
- themoonisachees 4y agoI agree that cloud providers are a blessing to attackers, but blocking russian, chinese and even generally SEA ip space is still a very effective way of stopping the bottom 70% of all attacks. Sure, they're trying such outdated methods that there is very little chance of them suceeding, but honestly when just banning china reduces sshd logs by 50% you wonder why you didn't do it sooner.
- londons_explore 4y agoAre you sure you're blocking 70% of attacks? Or are attackers just starting there, and when they realise their attacks aren't working they go via AWS instead? I can't imagine many people sufficiently motivated to launch a DDoS attack against you, yet not sufficiently motivated to switch to an attack method that will actually work.
- bliteben 4y agoMost attacks are using a shotgun approach. DDOS generally are targeted but even then just badly behaved scrapers or vulnerability scanners can add up to be like a DDOS.
- BenjiWiebe 4y agoAn even quicker way to clean up SSH logs is to listen on a non standard port.
- rixrax 4y ago>> The block $insert_country IP range "solution" is an outdated mentality that should have died off in the 90's. Maybe so. But it works really well. After blocking certain countries IP ranges / ASes, >70% of abuse we had to deal with just vanished. Also there are other reasons to block: since the russians attacked Ukraine, business I work with no longer does business with russia, belarusia and few other countries as a matter of principle (and because of sanctions).
- 4y ago
- ignoramous 4y agoMost phishing attacks I've seen are hosted in the US too. I guess that's not only because the US is an absolute mammoth when it comes to Internet infrastructure that no one dares block its IPs, but also it has the cheapest rates for just about anything.
- OmarAssadi 4y agoYep. For many years, horrific American providers like C…C….ing had been super well-known effectively allow DDoS amplification attacks.