The Russians Are Getting More Active...

[Gerowen]

I've been  hosting my own Nextcloud for years now and the only person who ever actually got auto-banned was myself on accident a few times, but I've gotten three of these messages from my server just in the past week.  Everything seems to be holding up just fine; no unusual login activity in Nextcloud, no strange activity in any of my logs, etc.  I cranked up the bantime to multiple days because I figure if it's an accidental ban, it literally takes me 10 seconds to go remove it, but if it's somebody who needs to be banned, I want them to get tired of waiting and move on.  Wonder why they decided to start picking on me all of a sudden.

 

[Guest]

At least hide the IP of that person

[Guest]

11 minutes ago, Eviljuche said:

That IP belongs to an enterprise, not some person

But still someone can DDos that IP

[Levent]

4 minutes ago, WickedThunder86 said:

But still someone can DDos that IP

Sure, let me take down that persons internet. DDOS attacks are not what they used to be in 2008.

[Levent]

44 minutes ago, Gerowen said:

I've been  hosting my own Nextcloud for years now and the only person who ever actually got auto-banned was myself on accident a few times, but I've gotten three of these messages from my server just in the past week.  Everything seems to be holding up just fine; no unusual login activity in Nextcloud, no strange activity in any of my logs, etc.  I cranked up the bantime to multiple days because I figure if it's an accidental ban, it literally takes me 10 seconds to go remove it, but if it's somebody who needs to be banned, I want them to get tired of waiting and move on.  Wonder why they decided to start picking on me all of a sudden.

 

You can block entire IP ranges by few clicks if you are running a firewall. If not, you can always block manually. I personally have blocked all Russian, Chinese and Syrian IP ranges on all my network entry points.

https://www.ip2location.com/free/visitor-blocker

[Gerowen]

7 hours ago, Levent said:

You can block entire IP ranges by few clicks if you are running a firewall. If not, you can always block manually. I personally have blocked all Russian, Chinese and Syrian IP ranges on all my network entry points.

https://www.ip2location.com/free/visitor-blocker

Ya know that's not a bad idea. I don't work with or talk to anybody in either of those places, so I could just block those entire ranges in my router.

[Gerowen]

17 hours ago, WickedThunder86 said:

At least hide the IP of that person

I mean, an IP isn't really sensitive or confidential information. In most cases they don't tell you where somebody lives, their name, etc., just who their ISP is. I had 4 more attempts last night, this time from China, but I'm pretty sure it was the same guy just resetting his Internet connection because the IPs were all pretty close to each other.

 

The increased traffic I think can probably be traced to one of two things.

 

1) I have a link to my public PGP key, which is shared from my Nextcloud, in my email signature, and I regularly send emails out to a distribution list with notifications about things like my Minecraft service.

 

2) One of my uncles recently died and I found some backed up files of his from where I'd worked on a computer for him a couple years ago. Those files contain family photos, recordings of him singing in church, etc., so I created usernames for his wife and kids and sent their passwords and a link to them via Facebook Messenger so they could go browse those files. So, it's certainly possible that one of them has malware on their computer or phone.

[jagdtigger]

@Gerowen
There is nice plugin in nextcloud called GeoBlocker, set it to white list and only allow you country. (I dont see any of this since pfblocker-ng blocks russia, china, and asia [plus recently added ukraine])

[Gerowen]

I got to reading the logs Fail2Ban sent and it looks like they didn't get banned for trying and failing to enter username/password credentials, they got banned because they tried accessing me via my IP address directly instead of my public domain name (trusted domain error).  So this leads me to believe it's not any of the people who I've sent links to, my IP just popped hot in a scan as one that has some open ports and people are just probing me to see what's available.