List of IP addresses to block reddit / bbs ---------------------------------------------------------------------- cloverskull · 2016-10-22 19:33 Hey guys, the massive DDoS attack aimed at Dyn was carried out by a botnet which was cultivated by telnetting to IoT devices and using default admin credentials to login. For our community, this simply means that our telnet nodes are likely to be tied up by people trying to cultivate more devices for their botnets. What I propose here is a running list of IP addresses that we should block. Should be pretty simple. I've already found a couple that were essentially DoSing my BBS earlier today and yesterday. Blocking them has been effective at restoring the BBS to a useful state. * 190.129.100.77 * 74.2.220.43 * 252.116.48.119 * 186.75.25.19 * 171.224.176.59 * 120.209.193.124 * 195.98.67.92 * 42.113.138.10 * 173.9.46.13 * 187.63.222.160 * 61.219.112.146 ---------------------------------------------------------------------- recourse7 · 2016-10-23 00:51 I have a honeypot running for this project as well. Will update with the attack source ips after 24 hours. Then if its helpful or atleast worth the effort maybe do a 24 hour new post with a bot. Might be fun project. ---------------------------------------------------------------------- cloverskull · 2016-10-23 22:10 That's a great idea - every 24 hours update the list of known bad ip's and botpost here (or somewhere). Thanks for setting this up! ---------------------------------------------------------------------- recourse7 · 2016-10-23 22:20 I'm down. I have a few other hosts I can run this honeypot on as well. More attack surfaces means more data. I'll see if its fesible. Hope you have a good day brother! ---------------------------------------------------------------------- recourse7 · 2016-10-24 18:45 103.16.31.131 103.9.226.27 109.70.229.233 111.58.1.248 111.59.119.145 111.59.19.253 111.59.211.152 111.59.234.83 111.59.43.214 111.9.244.229 112.164.145.238 112.43.18.124 112.44.112.53 117.141.183.213 117.175.206.60 117.175.213.218 117.181.158.147 117.181.25.98 117.181.26.75 117.181.44.199 117.181.76.126 117.182.107.134 117.182.129.115 117.182.219.161 117.182.52.39 117.182.80.151 117.190.167.86 117.191.143.78 120.42.188.179 121.146.28.238 121.147.208.102 121.201.112.200 121.5.23.100 122.194.11.15 123.16.168.242 125.162.209.77 14.184.155.149 142.0.39.137 146.255.233.254 171.34.70.133 179.223.155.66 183.129.160.229 183.222.65.136 183.222.65.152 183.222.68.48 185.132.94.228 186.81.124.207 188.26.166.125 189.150.30.223 191.33.152.17 191.54.234.156 195.154.200.56 210.13.71.220 211.107.254.232 211.43.74.246 218.161.124.95 218.52.167.78 223.114.48.84 223.116.35.30 223.116.57.59 223.86.113.227 36.183.2.162 36.187.140.130 36.187.208.126 36.76.78.63 36.83.168.63 46.172.91.20 5.185.94.54 58.208.132.7 59.124.26.75 71.96.23.199 78.186.58.68 79.119.170.59 81.108.87.119 83.209.148.25 85.234.35.124 87.223.177.232 95.165.178.130 97.121.47.96 Last 24 hours attack sources against telnet honeypot. ---------------------------------------------------------------------- mro_1337 · 2016-10-25 22:49 just block china, north korea and brazil, and russia ---------------------------------------------------------------------- cloverskull · 2016-10-26 01:05 I wish it was that easy. Lots of stuff from literally hundreds of countries. Adding those ip blocks to iptables results in denial of service to anyone trying to connect - things just time out. ---------------------------------------------------------------------- HerpieMcDerpie · 2016-10-26 10:27 I'd like to set up a honeypot. Could you point me in the direction of some resources to learn more about it and how to run one for this type of situation? ---------------------------------------------------------------------- mro_1337 · 2016-10-29 16:29 what are you talking about? are you sure you are using iptables correctly? i think you have the syntax wrong if you are having these connection issues. i have blocked countries last week. ---------------------------------------------------------------------- mro_1337 · 2016-10-29 16:36 This is a better way to go about blocking countries. block china, north korea, russia, brazil and whatever other countries you get attacks from. https://www.ip2location.com/blockvisitorsbycountry.aspx