Scan de CCbot

[farias]

Nouveau ajout de CCBot :

# wc -l /etc/pve/firewall/cluster.fw 
9251 /etc/pve/firewall/cluster.fw
# wc -l /etc/pve/firewall/cluster.fw
9952 /etc/pve/firewall/cluster.fw

[farias]

Je vais devoir faire encore une compression :

# grep "# CCBot" /etc/pve/firewall/cluster.fw  | awk '{print $4}' | grep -v "^$" | grep -v "/" | sort -n | sed 's/\./ /g'  | awk '{print $1 "." $2 "." $3 ".0/24"}' | sort -n | uniq -c | sort -n | awk '{print "IN DROP -source " $2 " -p tcp -log notice # CCBot compress"}' | tail -10
IN DROP -source 177.131.178.0/24 -p tcp -log notice # CCBot compress
IN DROP -source 177.152.87.0/24 -p tcp -log notice # CCBot compress
IN DROP -source 177.54.199.0/24 -p tcp -log notice # CCBot compress
IN DROP -source 181.91.86.0/24 -p tcp -log notice # CCBot compress
IN DROP -source 187.180.212.0/24 -p tcp -log notice # CCBot compress
IN DROP -source 14.191.161.0/24 -p tcp -log notice # CCBot compress
IN DROP -source 14.191.163.0/24 -p tcp -log notice # CCBot compress
IN DROP -source 14.191.230.0/24 -p tcp -log notice # CCBot compress
IN DROP -source 14.191.25.0/24 -p tcp -log notice # CCBot compress
IN DROP -source 14.191.92.0/24 -p tcp -log notice # CCBot compress

[farias]

Je suis tellement gonflé que je vais mettre :

IN DROP -source 14.191.0.0/16 -p tcp -log notice # CCBot compress Vietnam

[farias]

En gros :

# grep "# CCBot" /etc/pve/firewall/cluster.fw  | awk '{print $4}' | grep -v "^$" | grep -v "/" | sort -n | sed 's/\./ /g'  | awk '{print $1 "." $2 ".0.0"}' | sort -n | uniq -c  | sort -n | tail
     41 179.125.0.0
     42 177.37.0.0
     54 113.172.0.0
     55 123.21.0.0
     67 14.186.0.0
     67 14.187.0.0
     73 113.173.0.0
     73 14.169.0.0
     83 123.20.0.0
    221 14.191.0.0

[farias]

Finalement je vais mettre :

IN DROP -source 14.169.0.0/16 -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 123.20.0.0/16 -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 14.191.0.0/16 -p tcp -log notice # CCBot compress Vietnam

[farias]

Je pense qu’il faut bloquer tous le Vietnam :

IN DROP -source 113.172.0.0/16  -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 123.21.0.0/16 -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 14.186.0.0/16 -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 14.187.0.0/16 -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 113.173.0.0/16 -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 14.169.0.0/16 -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 123.20.0.0/16 -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 14.191.0.0/16 -p tcp -log notice # CCBot compress Vietnam

[farias]

Première fois que j’ai une liste aussi courte …

IN DROP -source 14.244.113.213 -p tcp -log notice # CCBot
IN DROP -source 36.76.141.212 -p tcp -log notice # CCBot
IN DROP -source 39.194.5.127 -p tcp -log notice # CCBot
IN DROP -source 45.182.243.249 -p tcp -log notice # CCBot
IN DROP -source 45.239.229.164 -p tcp -log notice # CCBot
IN DROP -source 117.5.147.154 -p tcp -log notice # CCBot
IN DROP -source 123.16.246.87 -p tcp -log notice # CCBot
IN DROP -source 125.167.51.134 -p tcp -log notice # CCBot
IN DROP -source 138.117.55.41 -p tcp -log notice # CCBot
IN DROP -source 138.59.239.70 -p tcp -log notice # CCBot
IN DROP -source 152.174.97.241 -p tcp -log notice # CCBot
IN DROP -source 170.150.132.229 -p tcp -log notice # CCBot
IN DROP -source 170.246.81.226 -p tcp -log notice # CCBot
IN DROP -source 177.129.25.77 -p tcp -log notice # CCBot
IN DROP -source 177.184.101.224 -p tcp -log notice # CCBot
IN DROP -source 177.189.108.89 -p tcp -log notice # CCBot
IN DROP -source 177.220.186.160 -p tcp -log notice # CCBot
IN DROP -source 179.125.149.52 -p tcp -log notice # CCBot
IN DROP -source 181.209.78.10 -p tcp -log notice # CCBot
IN DROP -source 181.46.185.101 -p tcp -log notice # CCBot
IN DROP -source 186.248.207.130 -p tcp -log notice # CCBot
IN DROP -source 200.100.17.102 -p tcp -log notice # CCBot
IN DROP -source 200.236.234.166 -p tcp -log notice # CCBot
IN DROP -source 201.13.60.69 -p tcp -log notice # CCBot
IN DROP -source 201.50.138.239 -p tcp -log notice # CCBot
IN DROP -source 202.59.194.99 -p tcp -log notice # CCBot

[farias]

Je viens de l’ajouter à ma liste …

je vais aussi ajouter :

IN DROP -source 14.188.0.0/16 -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 1.54.0.0/16 -p tcp -log notice # CCBot compress Vietnam
IN DROP -source 36.76.0.0/16 -p tcp -log notice # CCBot compress Indonesie
IN DROP -source 45.182.0.0/16 -p tcp -log notice # CCBot compress Bresil

[farias]

Aie … uniquement 3 aujourd’hui :

# grep '"CCBot"' /var/log/apache2/acces*log | sed 's/:/ /g' | awk '{print $2}' | sort -n | uniq | awk '{print "IN REJECT -source " $1 " -p tcp -log notice # CCBot"}' 
IN REJECT -source 114.130.186.201 -p tcp -log notice # CCBot
IN REJECT -source 177.234.217.135 -p tcp -log notice # CCBot
IN REJECT -source 190.97.224.56 -p tcp -log notice # CCBot

[farias]

On dirait que le blocage de 3% des IPs à porté ses fruits :

[farias]

Le prix sur les architectures de CCbot est énorme :