{"id":1653,"date":"2024-04-22T15:14:37","date_gmt":"2024-04-22T19:14:37","guid":{"rendered":"https:\/\/www.rfdm.com\/blog\/?p=1653"},"modified":"2024-04-22T17:55:26","modified_gmt":"2024-04-22T21:55:26","slug":"more-ases-blocked-from-my-web-server","status":"publish","type":"post","link":"https:\/\/www.rfdm.com\/blog\/?p=1653","title":{"rendered":"More ASes blocked from my web server"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The following ASes are now blocked from my home network.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>208077  COMPASTELECOM LLP (KZ)<\/li>\n\n\n\n<li>41039 Timer, LLC (RU)<\/li>\n\n\n\n<li>8717 A1 Bulgaria EAD (BG)<\/li>\n\n\n\n<li>39927 E-Light-Telecom Ltd. (RU)<\/li>\n\n\n\n<li>17557 Pakistan Telecommunication Company Limited (PK)<\/li>\n\n\n\n<li>12997 OJSC Kyrgyztelecom (KG)<\/li>\n\n\n\n<li>24921 Latvijas Mobilais Telefons SIA (LV)<\/li>\n\n\n\n<li>133278 Dehradun Enet Solutions Private Ltd (IN)<\/li>\n\n\n\n<li>45536 Readylink Internet Services Limited (IN)<\/li>\n\n\n\n<li>37061 Safaricom (KE)<\/li>\n\n\n\n<li>36947 ALGTEL-AS (DZ)<\/li>\n\n\n\n<li>9260 Multinet Pakistan Pvt. Ltd. (PK)<\/li>\n\n\n\n<li>141334 Skynet Digital Services Pvt. Ltd. (IN)<\/li>\n\n\n\n<li>36994 Vodacom-VB (ZA)<\/li>\n\n\n\n<li>48004 PE Tsibrankov Konstantin Igorevich (UA)<\/li>\n\n\n\n<li>3326 Datagroup PRIVATE JOINT STOCK COMPANY (UA)<\/li>\n\n\n\n<li>134032 INFONET COMM ENTERPRISES (IN)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This was triggered by the following log entries.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\" style=\"font-size:11px\">212.46.56.169 - - [22\/Apr\/2024:04:43:14 -0400] \"GET \/wp-login.php HTTP\/1.1\" 301 239\n195.184.214.82 - - [22\/Apr\/2024:04:44:16 -0400] \"GET \/wp-login.php HTTP\/1.1\" 301 239\n195.24.40.178 - - [22\/Apr\/2024:04:45:41 -0400] \"GET \/wp-login.php HTTP\/1.1\" 301 239\n176.196.46.109 - - [22\/Apr\/2024:04:46:04 -0400] \"GET \/admin\/ HTTP\/1.1\" 301 233\n182.180.35.167 - - [22\/Apr\/2024:04:46:30 -0400] \"GET \/admin\/ HTTP\/1.1\" 301 233\n212.97.4.143 - - [22\/Apr\/2024:04:47:21 -0400] \"GET \/admin\/ HTTP\/1.1\" 301 233\n80.89.79.165 - - [22\/Apr\/2024:04:48:07 -0400] \"GET \/admin\/ HTTP\/1.1\" 301 233\n103.230.153.134 - - [22\/Apr\/2024:04:49:27 -0400] \"GET \/downloader\/ HTTP\/1.1\" 301 238\n103.230.153.134 - - [22\/Apr\/2024:04:49:29 -0400] \"GET \/downloader\/ HTTP\/1.1\" 404 196\n103.230.153.134 - - [22\/Apr\/2024:04:49:33 -0400] \"GET \/admin.php HTTP\/1.1\" 301 236\n103.21.79.131 - - [22\/Apr\/2024:04:49:56 -0400] \"GET \/admin.php HTTP\/1.1\" 301 236\n41.139.174.67 - - [22\/Apr\/2024:04:50:20 -0400] \"GET \/admin.php HTTP\/1.1\" 301 236\n41.104.30.47 - - [22\/Apr\/2024:04:50:32 -0400] \"GET \/admin.php HTTP\/1.1\" 301 236\n125.209.67.210 - - [22\/Apr\/2024:04:51:40 -0400] \"GET \/Backoffice\/ HTTP\/1.1\" 301 238\n125.209.67.210 - - [22\/Apr\/2024:04:51:41 -0400] \"GET \/Backoffice\/ HTTP\/1.1\" 404 196\n103.159.107.172 - - [22\/Apr\/2024:04:51:44 -0400] \"GET \/administrator\/ HTTP\/1.1\" 301 241\n105.246.210.136 - - [22\/Apr\/2024:04:52:08 -0400] \"GET \/administrator\/ HTTP\/1.1\" 301 241\n195.18.19.81 - - [22\/Apr\/2024:04:53:04 -0400] \"GET \/administrator\/ HTTP\/1.1\" 301 241\n93.183.203.243 - - [22\/Apr\/2024:04:53:25 -0400] \"GET \/administrator\/ HTTP\/1.1\" 301 241\n103.58.115.60 - - [22\/Apr\/2024:04:53:39 -0400] \"GET \/administrator\/ HTTP\/1.1\" 301 241\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note that all of the probes seen in the log above occurred within about 10 minutes.  Also note that almost none of them handled 301.  This is the signature of a poorly implemented botnet.  Also note that they&#8217;re all from continents other than my own.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I&#8217;m still working on the automation for this, but the scheme is working.  For a given nefarious query, I look up the route in the global BGP routing table to find the origin AS (in my local copy, using my Ipv4Routes class).  I then look up the country for the origin AS, and based on my configured policy, block the entire AS for up to 2 years.  For example, Russian (RU) ASes are always blocked for 2 years.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Later I saw similar activity that triggered the blocking of the following ASes.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>35816 SEVSTAR Lancom Ltd. (RU)<\/li>\n\n\n\n<li>53754 SYSTEMA Ltd (RU)<\/li>\n\n\n\n<li>58310 TELEPORT LLC (RU)<\/li>\n\n\n\n<li>208142 LLC Rocket Telecom (RU)<\/li>\n\n\n\n<li>7303 Telecom Argentina S.A. (AR)<\/li>\n\n\n\n<li>28075 ARLINK S.A. (AR)<\/li>\n\n\n\n<li>5384 EMIRATES TELECOMMUNICATIONS GROUP COMPANY (ETISALAT GROUP) PJSC (AE)<\/li>\n\n\n\n<li>7418 TELEFONICA CHILE S.A. (CL)<\/li>\n\n\n\n<li>9541 Cyber Internet Services Pvt Ltd. (PK)<\/li>\n\n\n\n<li>12735 TurkNet Iletisim Hizmetleri A.S. (TR)<\/li>\n\n\n\n<li>13489 EPM Telecomunicaciones S.A. E.S.P. (CO)<\/li>\n\n\n\n<li>17858 LG POWERCOMM (KR)<\/li>\n\n\n\n<li>25553 TRK Gluhov Ltd. (UA)<\/li>\n\n\n\n<li>28458 IENTC S DE RL DE CV (MX)<\/li>\n\n\n\n<li>35457 Etisalcom Bahrain Company W.L.L. (BH)<\/li>\n\n\n\n<li>62240 Clouvider Limited (GB)<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The following ASes are now blocked from my home network. This was triggered by the following log entries. 212.46.56.169 &#8211; &#8211; [22\/Apr\/2024:04:43:14 -0400] &#8220;GET \/wp-login.php HTTP\/1.1&#8221; 301 239 195.184.214.82 &#8211; &#8211; [22\/Apr\/2024:04:44:16 -0400] &#8220;GET \/wp-login.php HTTP\/1.1&#8221; 301 239 195.24.40.178 &#8211; &#8211; [22\/Apr\/2024:04:45:41 -0400] &#8220;GET \/wp-login.php HTTP\/1.1&#8221; 301 239 176.196.46.109 &#8211; &#8211; [22\/Apr\/2024:04:46:04 -0400] &#8220;GET \/admin\/ &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.rfdm.com\/blog\/?p=1653\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;More ASes blocked from my web server&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[85,86,12],"tags":[],"class_list":["post-1653","post","type-post","status-publish","format-standard","hentry","category-network-security","category-networks","category-software-development"],"_links":{"self":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1653"}],"version-history":[{"count":10,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1653\/revisions"}],"predecessor-version":[{"id":1664,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1653\/revisions\/1664"}],"wp:attachment":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1653"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1653"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}