cybersecurity companies scanning my chickenfarm, report to RIPE/IANA?

dbadude · April 2

@rcy026 said:

@dbadude said:

@rcy026 said:
What is your definition of 'hacking'?
I have lots of connection attempts in my firewalls, that does not necessarily mean they are attempting to hack me. It could be anything from webcrawlers or indexers gathering statistics about webservers or ip usage or whatever statistics people are interested in, or even a misconfigured dns server somewhere pointing at my ip's. A mere connection attempt does not qualify as 'hacking' in my book.

port scanning is.

Then the obvious follow up question has to be what is your definition of port scanning? How many different ports needs to be tested and in what timeframe? Are we talking about 10 different ports in a minute or like 1000 ports per second?

man, drink your coffee

rcy026 · April 2

@dbadude said:

@rcy026 said:

@dbadude said:

@rcy026 said:
What is your definition of 'hacking'?
I have lots of connection attempts in my firewalls, that does not necessarily mean they are attempting to hack me. It could be anything from webcrawlers or indexers gathering statistics about webservers or ip usage or whatever statistics people are interested in, or even a misconfigured dns server somewhere pointing at my ip's. A mere connection attempt does not qualify as 'hacking' in my book.

port scanning is.

Then the obvious follow up question has to be what is your definition of port scanning? How many different ports needs to be tested and in what timeframe? Are we talking about 10 different ports in a minute or like 1000 ports per second?

man, drink your coffee

Already did, but what does that have to do with anything?
I'm just trying to set down a baseline for what we are talking about here, since I strongly suspect that what you call "hacking" is just common internet background noise.

JohnFilch123 · April 2

@dbadude said:
why does all threads end in gay sex on this site?

Low end stupid humour

dbadude · April 2

@rcy026 said:

@dbadude said:

@rcy026 said:

@dbadude said:

@rcy026 said:
What is your definition of 'hacking'?
I have lots of connection attempts in my firewalls, that does not necessarily mean they are attempting to hack me. It could be anything from webcrawlers or indexers gathering statistics about webservers or ip usage or whatever statistics people are interested in, or even a misconfigured dns server somewhere pointing at my ip's. A mere connection attempt does not qualify as 'hacking' in my book.

port scanning is.

Then the obvious follow up question has to be what is your definition of port scanning? How many different ports needs to be tested and in what timeframe? Are we talking about 10 different ports in a minute or like 1000 ports per second?

man, drink your coffee

Already did, but what does that have to do with anything?
I'm just trying to set down a baseline for what we are talking about here, since I strongly suspect that what you call "hacking" is just common internet background noise.

SYN packets from the same subnet on random ports, no random noise. Do you think random people connect to random ip addresses and search for random ports which are not the usual ones http/https/imap/dns/etc...? portscan dude

CloudHopper · April 2

Either they're scanning the entire IP space to develop a Shodan-like platform or you're doing something that interests them.

But unless you share the ranges you're getting scanned by nobody can tell you whether they see similar scanning activity in their own logs, and without knowing your activities it's impossible to say why it's happening.

suyadi92 · April 2

Sue em.

dbadude · April 2

@CloudHopper said:
Either they're scanning the entire IP space to develop a Shodan-like platform or you're doing something that interests them.

But unless you share the ranges you're getting scanned by nobody can tell you whether they see similar scanning activity in their own logs, and without knowing your activities it's impossible to say why it's happening.

I know what is happening. I just wanted to know what is the follow up when your services are targeted. Nobody does something here I guess. Fail2ban is not the way to go or to share ip ranges, as its just a simple cat and mouse game. I'd rather stay away from this game at all. I switched to complete lockdown of ports and use only vpn software now. And the cloudflare ip's are whitelisted. Keeping a close on eye on them now...

rcy026 · April 2

@dbadude said:

@rcy026 said:

@dbadude said:

@rcy026 said:

@dbadude said:

@rcy026 said:
What is your definition of 'hacking'?
I have lots of connection attempts in my firewalls, that does not necessarily mean they are attempting to hack me. It could be anything from webcrawlers or indexers gathering statistics about webservers or ip usage or whatever statistics people are interested in, or even a misconfigured dns server somewhere pointing at my ip's. A mere connection attempt does not qualify as 'hacking' in my book.

port scanning is.

Then the obvious follow up question has to be what is your definition of port scanning? How many different ports needs to be tested and in what timeframe? Are we talking about 10 different ports in a minute or like 1000 ports per second?

man, drink your coffee

Already did, but what does that have to do with anything?
I'm just trying to set down a baseline for what we are talking about here, since I strongly suspect that what you call "hacking" is just common internet background noise.

SYN packets from the same subnet on random ports, no random noise. Do you think random people connect to random ip addresses and search for random ports which are not the usual ones http/https/imap/dns/etc...? portscan dude

I do not think anything, that is why I'm asking. You never revealed what kind of connection attempts we are talking about, what ports or at what rate, so to even be able to know what we are talking about I had to ask those questions.
And yes, people do connect to random ports, that is the background noise I was referring to. Random connects happen all the time, that was why I asked about at what rate those connections occur. For some reason you seem very reluctant to share that kind of information so I still have no clue if we are talking about targeted attacks or just noise.

rustelekom · April 2

In general, the problem is who is scanning your IP address. If it is done by CERT-BUND (a German governmental security organization) to warn the owner about possible vulnerabilities, then this is one case. If the scanning is done by an anonymous person for an unknown purpose, then this is a completely different case.

zed · April 2

definitely be one of those guys sending abuse reports to everybody related to the ips touching you

dbadude · April 2

i was scanning them and boom something for us to read....

We think you are doing a great job monitoring your systems and/or your networks. We hope that we are not causing any inconvenience.

Modat.io is an Internet search company. We index the Internet at the machine level. Typically, we scan hosts on a daily basis or less.

We publish all of our scanning IP addresses here:
https://scanner.modat.io/ipv4.txt
Please note that you can block any scans that you do not deem appropriate. We are only scanning. We do not perform any malicious behavior or conduct any actions that can be seen as an intrusion. We uphold the ethics code of scanning and responsible disclosure.

In our HTTP scans, Modat is included in the user agent string. This can help you clearly identify our scans.

Our user agent is: Mozilla/5.0 (compatible; ModatScanner/{VERSION}); +https://modat.io/)

You can also identify our scanners through reverse DNS. Our scanners follow this domain pattern:

*.scanner.modat.io

We are part of the worldwide security research community.

Thank you again,
The Modat Team

jsg · April 2

@dbadude said:
i was scanning them and boom something for us to read....
We think you are doing a great job monitoring your systems and/or your networks. We hope that we are not causing any inconvenience.

Modat.io is an Internet search company. We index the Internet at the machine level. Typically, we scan hosts on a daily basis or less.

We publish all of our scanning IP addresses here:
https://scanner.modat.io/ipv4.txt
Please note that you can block any scans that you do not deem appropriate. We are only scanning. We do not perform any malicious behavior or conduct any actions that can be seen as an intrusion. We uphold the ethics code of scanning and responsible disclosure.

In our HTTP scans, Modat is included in the user agent string. This can help you clearly identify our scans.

Our user agent is: Mozilla/5.0 (compatible; ModatScanner/{VERSION}); +https://modat.io/)

You can also identify our scanners through reverse DNS. Our scanners follow this domain pattern:

*.scanner.modat.io

We are part of the worldwide security research community.

Thank you again,
The Modat Team

I was about to say "just block their ranges" but now it's clear that you actually have multiple different options to block their scanning.

Also I had the questions in mind @rcy026 asked you.

dbadude · April 5

thread can be closed.

forest · April 5

@xvps said: You can report it to abuseipdb.com, but nobody else is interested in your overreaction and false accusations of hacking.

Reputable research organizations' subnets will be whitelisted on AbuseIPDB anyway.

forest · April 5

@dbadude said:

@rcy026 said:

@dbadude said:

@rcy026 said:

@dbadude said:

@rcy026 said:
What is your definition of 'hacking'?
I have lots of connection attempts in my firewalls, that does not necessarily mean they are attempting to hack me. It could be anything from webcrawlers or indexers gathering statistics about webservers or ip usage or whatever statistics people are interested in, or even a misconfigured dns server somewhere pointing at my ip's. A mere connection attempt does not qualify as 'hacking' in my book.

port scanning is.

Then the obvious follow up question has to be what is your definition of port scanning? How many different ports needs to be tested and in what timeframe? Are we talking about 10 different ports in a minute or like 1000 ports per second?

man, drink your coffee

Already did, but what does that have to do with anything?
I'm just trying to set down a baseline for what we are talking about here, since I strongly suspect that what you call "hacking" is just common internet background noise.

SYN packets from the same subnet on random ports, no random noise. Do you think random people connect to random ip addresses and search for random ports which are not the usual ones http/https/imap/dns/etc...? portscan dude

Port scanning is neither illegal nor intrinsically malicious. It's often a prelude to malicious actions when it's performed by a malicious actor, but chances are, you're being scanned by a fully legitimate research organization and they are not going to do anything to harm you. They're collecting non-private data.

The one and only reason that port scanning is often verboten among hosting providers is that people so often associate it with malicious activity that they report it and their IPs get added to blacklists which makes the (already expensive) IPv4 space harder to sell. Not because it's illegal.

If this really worries you, most of these research organizations allow you to opt out of future scanning. If not:

#!/usr/sbin/nft -f

flush ruleset

tablet inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        iif lo accept
        ct state { established, related } accept
        ct state new ip saddr $YOUR_HOME_IP_ADDR tcp dport ssh accept
        icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }
}

Howdy, Stranger!

Categories

In this Discussion

cybersecurity companies scanning my chickenfarm, report to RIPE/IANA?

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

cybersecurity companies scanning my chickenfarm, report to RIPE/IANA?

Comments