Got my first script kiddy
-
If I showed you my WAN-side firewall logs you'd have a panic attack. I have a /29 block and about 10 scans tap one IP or another every second. It's part of being on the internet.
Your domestic home router experiences the exact same thing. Every moment of every day.
Will you report every scan? Every Chinese IP? Every US IP? It's completely common place to have someone 'knock on the door'.
Get off IPv4 anyway and onto IPv6. Good luck to them finding you by chance in there.
I ran a Tor relay on one of my spare servers for a while, and my god did that thing get port scanned. Even two years after I stopped hosting the relay, it was still getting pinged every 5-10 seconds (while my other servers tend to get pinged "only" once ever 20-30 seconds).
-
Sure but there are just some things you can’t run over ipv6
Such as?
-
Nice big old port scan. Brand new server too. Just a few days old so there is nothing to find. Don't worry I contacted AWS. Stay safe out there.
Trying to learn here, are these SSH login attempts on the root user? If not, is it just the firewall logs?
-
Such as?
Some game servers, some ISPs don't provide IPv6 for (some of) their customers.
-
Some game servers, some ISPs don't provide IPv6 for (some of) their customers.
Yup, we don't have IPv6, so we'd need a VPN or something to do that.
-
That's what automation is for
Or just close off the most common vectors, such as disabling root ssh login, doing key-only SSH auth, and block traffic from regions of the world you don't need to support.
-
Some game servers, some ISPs don't provide IPv6 for (some of) their customers.
Ah game servers yes that's fair. I found that with Astroneer. If the ISP doesn't provide V6 though it's time to switch ISPs.
Majority of traffic to Google is now V6 in most countries. Globally it's still just under 50%. https://www.google.com/intl/en/ipv6/statistics.html
-
Or just close off the most common vectors, such as disabling root ssh login, doing key-only SSH auth, and block traffic from regions of the world you don't need to support.
I got a huge reduction in random login attempts when I changed my ssh port away from the default.
(Of course I also have actual security measures like log in by key only)
-
Ah game servers yes that's fair. I found that with Astroneer. If the ISP doesn't provide V6 though it's time to switch ISPs.
Majority of traffic to Google is now V6 in most countries. Globally it's still just under 50%. https://www.google.com/intl/en/ipv6/statistics.html
If the ISP doesn't provide V6 though it's time to switch ISPs.
cries in USA
-
Not on AWS and yes I know I can't stop port scanning and bad traffic is a thing. Doesn't stop me from filling out the form. I think to piss off you and the other commenters, I'll write a script to auto fill out AWS abuse forms. Also script kiddy or bot, all the same to me, their hosting provider is getting a message from me
wrote last edited by [email protected]I'll write a script to auto fill out AWS abuse forms
Sounds like you are the script kiddie here
-
If the ISP doesn't provide V6 though it's time to switch ISPs.
cries in USA
You could always get a tunneled V6 line but it's a lot of hassle for something you should have by default.
Us europoors may not have golden toilet seats and medical insurance, or V8 Chevvies, or American Size Mayonnaise, but we have our 2a02:7892:1234:::/64!!!!!
Monopolistic control of buildings by one ISP is illegal in most Euro countries
-
Nice big old port scan. Brand new server too. Just a few days old so there is nothing to find. Don't worry I contacted AWS. Stay safe out there.
wrote last edited by [email protected]I think a lot of peope understandably misunderstand this post because it doesn't really explain the situation. After reading OP's comments I gather that OP put a new server online (not on AWS) and was immediately port scanned by a host that is on AWS. Since OP did not consent to being port scanned, they filled out an abuse complaint with AWS, the hoster the scan came from, out of principle, knowing that it probably won't do much. Which is totally fine if that is how you want to spend your time.
I think what most commenters thought is that OP was hosting with AWS and complained to them that someone else scanned their server. This does not seem to be the case.
