Different day, similar stuff. One thing that has changed here is that I’ve disabled port 587 (submission) on my gateway, since the only mail I care about receiving on my local mail server is generated locally. I also added to the list of those I block from IMAPS. So now the spammers and those attempting to relay show up, as well as those trying to access my IMAPS service for my local mail. Hurricane Electric is a primary offender here, as is G-Core Labs. All of the traffic from Redoubt Networks is for port 587; they’re apparently happy to host spammers.
The total count of unacknowledged SYNs received on this day: 37,611. On average, that’s one every 1.81 seconds. Put another way, about 26 per minute. The disheartening part: this is more than 8X the number of SYNs I accepted. 89.5% of the TCP connection attempts directed at my home network from the public Internet are rejected.
Think about that for a minute… almost 90% of attempted incoming TCP connections are unwanted garbage. This is the modern Internet. 🙁
If you’re a webmaster or content creator, it’s worth noting that my two leading offenders, Microsoft and Amazon, are both defendants in lawsuits involving copyright. The problem here is that big tech is scraping every web site they can for LLM and other AI training data, seemingly with little to no regard for copyright or attribution. See https://www.theregister.com/2024/03/13/nyt_hacking_response/ for The NY Times claim against Microsoft and OpenAI, and https://www.theregister.com/2024/04/22/ghaderi_v_amazon/ for a claim against Amazon. In today’s landscape, blocking just their address space isn’t going to stop them since they can buy hosting elsewhere just like the rest of us. But I’m coming to the conclusion that I shouldn’t make it easy for any of them.