[cfp-interest 3380] Re: a sampler of active attacking subnets

[David Chen]

Hi David,

I’m using the Firewalla Gold SE to protect my home office, which allows
blocking by IP address range, domain, or region. Currently, 82% of internet
traffic is blocked here, even without using those specific blocking
features. I’m wondering if a physical firewall with those types of blocking
options could be helpful for you

Best,
David.


On Mon, Feb 10, 2025 at 5:47 PM Damian McGuckin <damianm at esi.com.au> wrote:

>
> Young David,
>
> On Mon, 10 Feb 2025, David Hough CFP wrote:
>
> >  25458 138.204.48  LACNIC TURBONET INFO E TELECOM
> >  25115 170.78.162  LACNIC TURBONET INFO E TELECOM
> >  24193 138.94.53   LACNIC ANDRADE & LANDIM TELECOMUNICACOES LTDA
> >  15780 177.73.104  LACNIC FATIMA VIDEO ELETRONICA LTDA ME
> >  14546 45.165.65   LACNIC MAURILIO SANTANA DE AZEVEDO LTDA
> >  13090 45.164.39   LACNIC OLIVEIRA TELECOM
> >  13120 177.190.173 LACNIC Interlink Comunicacao Virtual LTDA ME
> >  12835 45.165.67   LACNIC D. S. ALVES SERVICOS DE INTERNET
> >
> >  21228 45.142.193  RIPE Limited Network LTD
> >   2260 114.119.159 APNIC HUAWEI INTERNATIONAL PTE. LTD.
> >
> > Looks like some Brazilian ISP customers are pretty lax about security;
>
> Yes.
>
> > other ISP's will take anybody's money and look the other way -
>
> We found that with a lot of Singaporean ISPs several years ago.
>
> > when every host in a subnet is attacking,
> > there must be some common control over that subnet.
>
> Definitely. W got attacked for a few hours the other day from South Africa
> and Bulgaria before I dropped their packets on the floor rather than just
> blocking them. After that, they gave up.
>
> > There is a host of subnets with substantial access attempts less than
> > these.   HUAWEI was more active at the beginning but has since subsided.
>
> That looks like they have some way of finding naughty people and put a
> stop to some of it, at least to some extent. Not sure Huawei could afford
> to have that happening too often with their name attached to it.
>
> All pretty scary stuff.
>
> Thanks for your efforts - Damian
>
> _______________________________________________
> cfp-interest mailing list
> cfp-interest at oakapple.net
> http://mailman.oakapple.net/mailman/listinfo/cfp-interest
>


-- 
Best Regards,
David.

****Email Disclaimer*: This email is intended only for addressee(s), may be
confidential or proprietary, and may constitute inside information that is
protected from disclosure under law. If you are not the intended recipient,
you are hereby notified not to read, disclose, distribute or otherwise use
this email.  If you are not the intended recipient, please inform the
sender by reply email and destroy all copies of the original message.
Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.oakapple.net/pipermail/cfp-interest/attachments/20250211/5203764c/attachment-0001.htm>