Announcement

**Pete** · September 11, 2017, 06:41 AM

Personally I would beef up your firewall. Start off slowly maybe using the Pi Hole Firewall.

Not totally sure though about Pi Hole doing geoblocking.

Here have no ports open and only utilize VPN to get to my mothership at home.

Here utilize PFSense with Geoblocking enabled (via PFSense PFBlocker).

[ATTACH]63307[/ATTACH]

Why Reputation Matters:
By Enabling 'Reputation', each Blocklist will be analyzed for Repeat Offenders in each IP Range.
Example: x.x.x.1, x.x.x.2, x.x.x.3, x.x.x.4, x.x.x.5
No. of Repeat Offending IPs [ 5 ], in a Blocklist within the same IP Range.

With 'Reputation enabled, these 5 IPs will be removed and a single x.x.x.0/24 Block is used.
This will completely Block/Reject this particular range from your Firewall.

Selecting Blocklists from various Threat Sources will help to highlight Repeat Offending IP Ranges,
Its Important to select a Broad Range of Blocklists that cover different types of Malicious Activity.

You *may* experience some False Positives. Add any False Positive IPs manually to the
pfBlockerNGSuppress Alias or use the "+" suppression Icon in the Alerts TAB

To help mitigate False Positives 'Countries' can be 'Excluded' from this Process. (Refer to Country Code Settings)

Enabling De-Duplication is highly recommended before utilizing 'Reputation' processes.

**BillBurn** · September 11, 2017, 10:48 AM

If you haven't already, you may want to read this recent thread.

Changing your HS and HS Touch ports should defeat them in the short term.

**concordseer** · September 12, 2017, 07:01 PM

Yes I noticed that a while back. Thanks.

**Pete** · September 12, 2017, 07:13 PM

It is difficult these days to avoid the dark side of the internet.

Mostly these are very sophisticated bots (just computers on the Internet running software) and getting more and more sophisticated over time.

Around 40% of the world population has an Internet connection today.

Internet users in the world

**Kerat** · September 13, 2017, 05:06 PM

Hackers busy last night

Here, I use PFBlockerNG on @Pete's recommendation. I use trusted public block lists to block traffic to and from malicious,illicit,ad based, tracking, compromised IP addresses.

I also implemented DNSBL on my PFBlockerNG. It blocks DNS requests to malicious or illicit content. I then forward all DNS requests to public name servers to my dns server to stop users from bypassing the rules.

This configuration works very similar to the way a pi-hole is setup.

Based on your log, you will notice that the attacker is waiting about 32 minutes in between attacks, is using commonly distributed general account names (manager, admin, tomcat, blank, etc), and only trying passwords 6 times. this to me seems to be a common bruteforce bot based attack method.

I have anti hack enabled in my HS3 environment. When an attacker hits my public IP on the appropriate port and enter a bad password X times, their source IP address is blocked from access. This serves as an effective countermeasure for bruteforce bot based attacks.

I am working to implement this more globally across all my services, using my network monitoring tool, and PFBlockerNG with a custom blacklist.

The other countermeasure I am working to implement is to force clients to my publicly accessible sites to authenticate themselves with a certificate I assign to the client device. This allows for 2 factor authentication (credentials = something you know, client certificate = something you have).

Sent from my iPhone using Tapatalk

**Guest** · September 17, 2017, 08:38 AM

I'm getting hit hard as well different IP's

Web Server Web Server login failed from: 27.152.30.106 User: guser
Sep-16 8:15:25 AM Web Server Web Server login failed from: 27.152.30.106 User: guest
Sep-16 8:15:25 AM Web Server Web Server login failed from: 27.152.30.106 User: user
Sep-16 8:15:24 AM Web Server Web Server login failed from: 27.152.30.106 User: user
Sep-16 8:15:23 AM Web Server Web Server login failed from: 27.152.30.106 User: user
Sep-16 8:15:22 AM Web Server Web Server login failed from: 27.152.30.106 User: user
Sep-16 8:15:22 AM Web Server Web Server login failed from: 27.152.30.106 User: user
Sep-16 8:15:21 AM Web Server Web Server login failed from: 27.152.30.106 User: user
Sep-16 8:15:20 AM Web Server Web Server login failed from: 27.152.30.106 User: user
Sep-16 8:15:19 AM Web Server Web Server login failed from: 27.152.30.106 User: user
Sep-16 8:15:19 AM Web Server Web Server login failed from: 27.152.30.106 User: user
Sep-16 8:15:18 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:17 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:16 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:16 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:15 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:14 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:13 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:12 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:12 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:11 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:10 AM Web Server Web Server login failed from: 27.152.30.106 User: admin
Sep-16 8:15:09 AM Web Server Web Server login failed from: 27.152.30.106 User: admin

Results for 45.77.105.179
Hostname 45.77.105.179.vultr.com
IP 45.77.105.179
Domain vultr.com
Organization Choopa, LLC
Location Matawan, New Jersey, United States

Announcement

Hackers busy last night

Hackers busy last night

Comment

Comment

Comment

Comment

Comment

Comment