nanog mailing list archives
Re: shadowserver.org
From: Doug McIntyre <merlyn () geeks org>
Date: Mon, 28 Jun 2021 13:56:36 -0500
On Mon, Jun 28, 2021 at 07:42:11PM +0300, Nathaniel Ferguson wrote:
I thought I'd add because it seems relevant and this is a pet peeve of my own, but with some notable exceptions-- anymore you can more or less think of a port scan as generally being a network diagnostic of some sort. Most of the stuff that says its a precursor to an attack is outdated...
I'd say my public facing servers are under constant attack of some level of utility. Ie. my honeypot email servers collect 100k+ connections a day each, that don't have any MX pointing to them, their only sin is being up and listening to port 25. They can't process a single email in or out. My web servers have a constant barage of accesses that aren't hitting valid URIs. Sometimes they hit on some pattern that starts forming a small DoS on them and I have to go block or auto-block them. The white-hat scanners like Shodan or Shadowserver are a small drop in the bucket compared to the malicious scans that constantly are going on. Perhaps it is easier to find Shodan or Shadowserver as they are fairly consistant and easily identifiable, vs. the constant E2C or other fly-by-night cloud services being abused.
Current thread:
- shadowserver.org Scott Aldrich (Jun 28)
- Re: shadowserver.org Bill Woodcock (Jun 28)
- Re: shadowserver.org Hank Nussbacher (Jun 28)
- Re: shadowserver.org Tom Beecher (Jun 28)
- Re: shadowserver.org Jim (Jun 28)
- RE: shadowserver.org Jean St-Laurent via NANOG (Jun 28)
- Re: shadowserver.org Jim (Jun 28)
- Re: shadowserver.org Fernando Gont via NANOG (Jun 28)
- Re: shadowserver.org Nathaniel Ferguson (Jun 28)
- Re: shadowserver.org Doug McIntyre (Jun 28)
- Re: shadowserver.org Matthew Petach (Jun 28)
- Re: shadowserver.org Jim (Jun 28)
- Re: shadowserver.org Jay Hennigan (Jun 28)
- <Possible follow-ups>
- Re: shadowserver.org Hank Nussbacher (Jun 28)
- RE: shadowserver.org Jean St-Laurent via NANOG (Jun 28)
- Re: [EXTERNAL] RE: shadowserver.org Compton, Rich A (Jun 28)
- RE: shadowserver.org Jean St-Laurent via NANOG (Jun 28)