Hi Keith Stanford University you say? At work I had some suspicious traffic from some Stanford University addresses. I contacted there abuse contact and it turned out they host a commercial vulnerability scanning service. In my case they had a legitimate contract to do this, but the message had not reached me. It's possible that in your case it's the same tool rather than students, so it may be worth contacting them to find out why they are scanning your services. Best wishes Ryan On Tue, 9 Apr 2019, 04:45 Keith Williams, <keithwilliamsnp(a)gmail.com> wrote:

On 09/04/2019 04:44, Keith Williams wrote: They're (probably) looking for a backdoor opened up by Windows malware. Why would that concern you?

I wish all the pesterees I have been monitoring came from one block. We had a run of being targeted by a botnet herder. The IP's were far too many, and far too globally diverse to summarize into a handy block. I did ensure it cost them a couple of bots though by forwarding on a size-able sample to the relevant abuse emails, looking them up via whois. For what good this does. (Very little). Wish there was a streamlined script/tool to do this. If everyone reported those that try it on, and ISP's did something about it, there would be a fraction at it. If I had more time and inclination (which I had neither) I would probably looked at the fact that they would have all been a consistent bot to see if I could reverse a bot and then take down the net, from what I had learned form the one. As my ssh was not a general use I could whitelist the ranges that would reasonably have access to it,  and port knock a disable to the whitelist to allow initial connections to be made from the wider net if we needed. Thereafter con-track allowed the session to continue. 80 and 443 I get, but what was on 7777, would that have been your ssh port by any chance ?? BTW it is difficult not to take it personally when it is something we have built and nurtured. Your feelings are fully understood. Noe where did I stash that minigun.... LOL Cheers Kirbs On 09/04/2019 04:44, Keith Williams wrote:

Hmm Not so long back I was gifted a (captured in the wild) bot script, so could have a rummage through it to see how it worked. It seemed to not only use a v fast scatter/gather ping method to detect live hosts but also had a section of code that looked for another botnet and did a takeover, using a passphrase that was written into the script. Kinda looks like bot herders are also into bot rustling. Either that or it was a botnet they had but lost the C&C for, after a take down action. Not sure, it is not really my thing. I am wondering if you were pestered by a small number of hosts from stanford that were infected with something similar. The primary route to infection would have been through a web exploit (Hence 80 and 443) and its secondary route was to take over another botnet that usually listens for C&C on 7777. If it is a common windows malware C&C port then it follows that the hosts pestering you were most likely (but not guaranteed to be) windows. Is your web server a windows OS ?? Why it fixated on your services I have no idea. Except for as you have suggested that your services looked like there were more of them than there were due to DNS aliasing. Hence why you saw more of it than anyone else's fair share of pestering. Cheers Kirbs On 09/04/2019 14:30, Keith wrote:

Bang goes that part, of that theory then. Kirbs On 09/04/2019 15:03, Keith wrote:

Every packet that arrives from them is sent to a chain by the firewall which logs them and then drops them. The log records the port they were blocked on. That's how I found the 7777. I had no idea what it was. I picked them up first because they hit on 22. that got them put in the set. Others in the set made a couple of attempts then disappeared. There is one oyher persistent pest, a well known comment spammer that keeps coming back and having a go for a while then disappearing, then just the usual rubbish On Tue, 9 Apr 2019 at 22:27, Dom Latter <bitfolk-users(a)latter.org> wrote:

I was just going to say it had stopped, LOL, a 15 minute break, then a burst, then a few minutes break. Seems to be slowing down but another is giving port 80 a hammering. Because I give these blackholes different names I can see the new contender is one of the content spammers. Oh well it's past midnight here so I will let them get on with their games On Tue, 9 Apr 2019 at 23:03, admins <admins(a)sheffieldhackspace.org.uk> wrote:

Out of interest, I took a look at me "PERMABAN" ipset list. It now has 5,296 addresses in it, with the top 5 offenders all having exceeded half a million hits each *since* having acted badly enough to end up in that list. Total packets across the list amounts to > 17 million, which means that the average offender continues trying > 3,000 times after ending up on the list. If anyone's interested, here's how I do it... I have an iptables chain called LOGANDBLOCK at the end of my INPUT chain. That does the usual log / tcp reset / drop sequence. But it also has the following rules: -m recent --rcheck --hitcount 20 --name LOGANDBLOCK --mask 255.255.255.255 --rsource -j SET --add-set PERMABAN src -m recent --set --name LOGANDBLOCK --mask 255.255.255.255 --rsource -m recent --rcheck --seconds 86400 --reap --name LOGANDBLOCK --mask 255.255.255.255 --rsource -m set --match-set PERMABAN src -m recent --remove --name LOGANDBLOCK --mask 255.255.255.255 --rsource Those say that any IP which has hit LOGANDBLOCK more than 20 times in the past day will get added to the PERMABAN ipset and removed from the LOGANDBLOCK recent list. They stay on the PERMABAN set forever, unless manually removed. My INPUT chain also contains, near the start: -m set --match-set PERMABAN src -j LOGANDBLOCK -m recent --rcheck --hitcount 5 --name LOGANDBLOCK --mask 255.255.255.255 --rsource -j LOGANDBLOCK So anyone who's in PERMABAN or who has hit LOGANDBLOCK 5 times in the past day will continue to do so. (i.e. you get blocked temporarily after 5 hits in 1 day, permanently after 20). Finally, I have a simple python script which watches my logs for dubious ssh attempts (like fail2ban does) and, when spotted, increments the LOGANDBLOCk xt_recent counter manually. So, hitting ssh 5 times dubiously gets you onto the firewall block list, same as hitting closed ports 5 times. Continuing to do so gets you onto the permaban list. Maybe banning after 20 hits/day is a bit aggressive, but nobody's complained to me yet! Cheers, Alun.