71–80 of 127 posts
https://thecyberwire.com/podcasts/research-saturday/247/note...
The numbers in that story (even at the low end) are eye popping :(
Little offtopic: "One of the things I've learned from this is that targeted blocking of only a few IPs is disproportionately effective at stopping brute force" This is very much true also for other types of attacks/scan/etc. Are you blocking Azure/OVH range on firewall ?
Fail2ban blocked 1087 ip addresses in the last week, which seems normal. I reset it and it has blocked eleven ip addresses in the last hour, mainly China and Digital Ocean as usual. Just to see what happens, I'v tried sending abuse reports about ssh brute force, vnc brute force and phishing sites, by the standard method of doing a whois lookup on the ip for the abuse email address. Some server and web hosting compani…
Honestly, I don't understand why people make reporting abuse so hard/labour-intensive. It is trivial to record netflow data (and most networks do that already), and then verify incoming abuse reports against those records.
Earlier quoted context omitted.
I've had this, too, and it later turned out that it was the VPS provider itself scanning my new instance for vulnerabilities.
Was it actually the provider scanning, or just a compromised VPS host using that same provider? It does seem proactive to scan customers' hosts then notify them if exploits are found.
I'm still seeing the same number of attempts on my public SFTP servers. As a funny side note I found that by going through the hardening steps on ssh-audit [1], most of the bots can't even negotiate a connection. I only see them because I configured verbose logging. They seem to be using really old ssh libraries in the bot code that severely limit the ciphers available to them. Another interesting side effect is that…
Also, if you don't use any other IP block list, do use DROP from Spamhaus: https://www.spamhaus.org/drop/ - that is small enough that you can run it on the webserver if you don't have much control over your connection to the outside world.
Earlier quoted context omitted.
Naw, advertisers are pretty good at detecting bots. Your CPM will quickly drop to 0.
Better redirect to a multi GB Linux ISO download.
I'm still seeing the same number of attempts on my public SFTP servers. As a funny side note I found that by going through the hardening steps on ssh-audit [1], most of the bots can't even negotiate a connection. I only see them because I configured verbose logging. They seem to be using really old ssh libraries in the bot code that severely limit the ciphers available to them. Another interesting side effect is that…
Same for www. Ratchet up the TLS/SSL - https://ssl-config.mozilla.org/ - go for modern and you'll see a lot of failed connections from bots and scanners. Also, if you don't use any other IP block list, do use DROP from Spamhaus: https://www.spamhaus.org/drop/ - that is small enough that you can run it on the webserver if you don't have much control over your connection to the outside world.