It’s been 7 years since I created and deployed my security automation software on my gateway (which runs FreeBSD). And for the 7th year in a row, the automation is blocking more IP address space from China than any other country.<\/p>\n\n\n\n
In other words, China continues to be the most hostile networked country. mcblockd is now blocking port 22 (ssh) from over 151 million IPv4 addresses in China. This isn’t really surprising or even news. Though it would be nice if the general public actually understood the persistent threat before whining that they don’t want TikTok to be divested from ByteDance (noting the legislation that recently passed the House of Representatives in the U.S.). I don’t know how to communicate how much attack traffic originates from China to a person who doesn’t understand IP networking. But I can say that in my own home, not more than a few minutes go by without probe and attack traffic hitting my gateway from China. It’s round the clock. Many users are relatively safe simply because none of their devices are running server software. What they don’t realize is that the probing is constant, and costs all of us bandwidth even if we have no servers at all.<\/p>\n\n\n\n
I bring this up because this weekend I did my annual perusal of my web server logs and added a bunch of networks to the list of those I deny. And in the process my average outbound traffic decreased by roughly 500 kilobits\/second.<\/p>\n\n\n\n
A continuing and growing annoyance that I don’t think our legislators, or for that matter our large hosting services, are minding: it continues to be the case that the bad guys are attacking us from cloud infrastructure, much of it on U.S. soil. It’s clear to me that various entities, since they’re profiting from it, just don’t care. Google, Amazon, Microsoft, DigitalOcean, GoDaddy, Hurricane Electric, PSINet, Cogent, OVH, Hetzner, Linode, others… they’re all used as weapons against our homes and small businesses connected to the Internet. In fact they’re incentivized… having your small business DDoS’ed or penetrated is an argument for moving your Internet services to the cloud.<\/p>\n\n\n\n
As an example annoyance, my web site fairly regularly gets hammered from address space owned by ‘FINE GROUP SERVERS LLC’ and ‘TrafficTransitSolution LLC’ which as near as I can tell are shell companies run by the Russian Federation. They utilize a truckload of small address space allocations (nearly all \/24), most of which are here in the U.S., to crawl my web site regularly. And some of their infrastructure is a pain in the ass to block because it’s within old PSINet large allocations and not called out in whois or RDAP data.<\/p>\n\n\n\n
At any rate, you can see the result of my annual maintenance below. My site was averaging 500 to 600 kilobits\/second outbound before I started adding new networks to my block list. I’m now back down to around 100 kilobits\/second.<\/p>\n\n\n\n It’s been 7 years since I created and deployed my security automation software on my gateway (which runs FreeBSD). And for the 7th year in a row, the automation is blocking more IP address space from China than any other country. In other words, China continues to be the most hostile networked country. mcblockd is … <\/p>\n![\"\"](\"https:\/\/www.rfdm.com\/blog\/wp-content\/uploads\/2024\/03\/sitetraffic_20240317.png\")
<\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"