search

spknetwork / honeycomb-spkcc

MIT License
4 stars 18 forks source link

netscan on port 7001 and 7770 #22

Closed mahdiyari closed 1 year ago

mahdiyari commented 1 year ago

My server got marked for abuse because of detected netscan on port 7001 It is trying a bunch of IP addresses on port 7001

mahdiyari commented 1 year ago 
Fri Feb 24 22:37:46 2023 TCP    49.12.242.34 4001  =>      198.18.0.6 7001
> Fri Feb 24 22:37:52 2023 TCP    49.12.242.34 4001  =>      198.18.0.6 7001
> Fri Feb 24 22:37:55 2023 TCP    49.12.242.34 4001  =>      198.18.0.6 7001
> Fri Feb 24 22:37:42 2023 TCP    49.12.242.34 4001  =>      198.18.0.7 7001
> Fri Feb 24 22:37:43 2023 TCP    49.12.242.34 4001  =>      198.18.0.7 7001
> Fri Feb 24 22:37:45 2023 TCP    49.12.242.34 4001  =>      198.18.0.7 7001
> Fri Feb 24 22:37:46 2023 TCP    49.12.242.34 4001  =>     198.18.0.11 7001
> Fri Feb 24 22:37:49 2023 TCP    49.12.242.34 4001  =>     198.18.0.18 7001
> Fri Feb 24 22:37:51 2023 TCP    49.12.242.34 4001  =>     198.18.0.18 7001
> Fri Feb 24 22:37:42 2023 TCP    49.12.242.34 4001  =>     198.18.0.19 7001
> Fri Feb 24 22:37:43 2023 TCP    49.12.242.34 4001  =>     198.18.0.23 7001
> Fri Feb 24 22:37:44 2023 TCP    49.12.242.34 4001  =>     198.18.0.23 7001
.
.
.
> Fri Feb 24 22:37:41 2023 TCP    49.12.242.34 4001  =>    198.18.1.218 7001
> Fri Feb 24 22:37:49 2023 TCP    49.12.242.34 4001  =>    198.18.1.236 7001
> Fri Feb 24 22:37:52 2023 TCP    49.12.242.34 4001  =>    198.18.1.247 7001
> Fri Feb 24 22:37:55 2023 TCP    49.12.242.34 4001  =>    198.18.1.247 7001
> Fri Feb 24 22:37:50 2023 TCP    49.12.242.34 4001  =>      198.18.2.5 7001
> Fri Feb 24 22:37:53 2023 TCP    49.12.242.34 4001  =>      198.18.2.5 7001
mahdiyari commented 1 year ago

I confirmed this is happening when the server is running honeycomb-spkcc using docker-composer and stops when I stop honeycomb-spkcc .

disregardfiat commented 1 year ago

4001 is a port used by ipfs. I'll look thru my logs to see if i have any similar issues.

vaultec81 commented 1 year ago

Going to close in favor of these on going topics on the IPFS side: https://github.com/ipfs/kubo/issues/5418 https://github.com/ipfs/kubo/issues/6932

mahdiyari commented 1 year ago

Those issues are 3 years old and will never get fixed from the looks of it.

vaultec81 commented 1 year ago

@disregardfiat Might be worth using the ipfs server profile in the docker container? I've been able to run ipfs on numerous providers with no issues (such as hetzner) for a good period of time now using that configuration.

disregardfiat commented 1 year ago

docker-compose updated