Over the past few weeks, I’ve had some issues with my site sometimes not being available or loading very slowly. Checking on the server I could see a high number of Apache processes and a memory usage about 5GB higher than usual. Issuing a netstat I could see that there were many connections from the same IP address: 185.62.189.162.
A whois on this address shows that this IP address belongs to a hosting company in Kiev, Ukraine called BlazingFast. I first blocked this IP address using iptables:
/sbin/iptables -A INPUT -s 185.62.189.162 -j DROPSince I have a monitoring script checking intrusion attempts and blocking IP addresses, I end up having lots of DROP rules in iptables. So once a week I clean them automatically. Usually hackers do not spend more than a week trying if they see that their traffic to my server is blocked anyway.
Here it was different. As soon as the rules where cleared, it started again with the exact same address. Of course, I immediately blocked this IP address again and sent an email to their abuse email address. But as expected never got an answer. Instead, the same thing happened again but coming from another similar IP address: 185.62.190.221. Whois shows that this address also belongs to the same Ukrainian hosting company.
So, since it was now clear that I’ll keep having problems with IP addresses belonging to this company, I decided to block all traffic coming for the IP ranges owned by them. First I checked what was their ASN on https://who.is/whois-ip/ip-address/185.62.190.221: AS60033. Then looked up their IP address blocks on https://ipinfo.io/AS60033.
Then all I had to do is use iptables to block traffic from these IP address blocks (and make sure that these rules stay in there):
/sbin/iptables -A INPUT -s 185.11.144.0/22 -j DROP
/sbin/iptables -A INPUT -s 185.11.145.0/24 -j DROP
/sbin/iptables -A INPUT -s 185.11.146.0/24 -j DROP
/sbin/iptables -A INPUT -s 185.11.147.0/24 -j DROP
/sbin/iptables -A INPUT -s 185.61.136.0/22 -j DROP
/sbin/iptables -A INPUT -s 185.62.188.0/23 -j DROP
/sbin/iptables -A INPUT -s 185.62.188.0/24 -j DROP
/sbin/iptables -A INPUT -s 185.62.189.0/24 -j DROP
/sbin/iptables -A INPUT -s 185.62.190.0/23 -j DROP
/sbin/iptables -A INPUT -s 185.62.190.0/24 -j DROP
/sbin/iptables -A INPUT -s 185.62.191.0/24 -j DROP
/sbin/iptables -A INPUT -s 188.209.48.0/23 -j DROP
/sbin/iptables -A INPUT -s 188.209.48.0/24 -j DROP
/sbin/iptables -A INPUT -s 188.209.49.0/24 -j DROP
/sbin/iptables -A INPUT -s 188.209.50.0/23 -j DROP
/sbin/iptables -A INPUT -s 188.209.52.0/23 -j DROP
/sbin/iptables -A INPUT -s 188.209.52.0/24 -j DROP
/sbin/iptables -A INPUT -s 188.209.53.0/24 -j DROPSo now the load on the server is fine again and unlike the past few weeks the hosted websites are always accessible and load fast.
It’s interesting to see that BlazingFast is advertizing with the DDOS protection service on hand and actually seem to have customers performing brute force attacks from their servers on the other. If you look up their ASN on the fail2ban reporting service, you will see that a few of their IP addresses are being blocked. So I am not the only one who’s been hit by this. Maybe they should not only focus on protecting their customers from DDOS attacks but should also prevent them from performing attacks.
This post on stackexchange also shows that it’s not something new but it looks like there were already attacks originating from one of their IP addresses in May. The answers to this post will also give you some alternative solutions to block them using the Apache .htaccess file, the Cisco firewall, Nginx, a Microsoft IIS Web Server rule, netsh ADVFirewall or CSF firewall.
I know it’s more difficult to identify attacks originating from one of your IP addresses than attacks targeting your network. As a hosting company, you definitely do not want to have to many false positive and block legitimate traffic created by your customers. But I’m still pretty mad having to waste so much time taking care of this kind of things…
Update 18/07/2015: I’ve ended up also blocking all IP blocks of the following companies: ISPsystem, cjsc and Lekosport-Kharkov LLC which were wasting my time and there’s trying to hack wp-login.php.
Update 20/07/2015: Today I’ve blocked additional IP blocks belonging to Kyivstar PJSC. Slowly I’m starting to think that I’ll have to block access to complete regions in order to be able to sleep at night without worrying…
The post Blocking all BlazingFast IP address blocks (ranges) appeared first on Benohead.
