How to exclude a CDN ?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Got few times an informal report containing something like: It is most likely the attack traffic is directed at one of the following endpoints: account.sonyentertainmentnetwork.com auth.np.ac.playstation.net auth.api.sonyentertainmentnetwork.com auth.api.np.ac.playstation.net I was just wondering how would somebody handle a request to exclude those IP addresses, b/c 2 attempts to get the affected netwrok gives: # host account.sonyentertainmentnetwork.com account.sonyentertainmentnetwork.com is an alias for account.sonyentertainmentnetwork.com.edgekey.net. account.sonyentertainmentnetwork.com.edgekey.net is an alias for e380.b.akamaiedge.net. e380.b.akamaiedge.net has address 104.109.72.158 # whois 104.109.72.158 | grep CIDR CIDR: 104.64.0.0/10 CIDR: 104.109.64.0/20 and at another system : ~/devel/wireshark $ host account.sonyentertainmentnetwork.com account.sonyentertainmentnetwork.com is an alias for account.sonyentertainmentnetwork.com.edgekey.net. account.sonyentertainmentnetwork.com.edgekey.net is an alias for e380.b.akamaiedge.net. e380.b.akamaiedge.net has address 184.24.193.168 $ whois 184.24.193.168 | grep CIDR CIDR: 184.24.0.0/13 CIDR: 184.24.192.0/20 - -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAleqBwUACgkQxOrN3gB26U7YXQD+PHgO8nVRo01abzdu1P7zC6TZ gDMkb+L51zt/k7hBJOsA/0czdSd8p8AnINKx+FP2Gi5ZSjVzzBuUM9o+htw5BdIX =Tz+I -----END PGP SIGNATURE-----
Got the same abuse mail on my exits ... you get a IP depending where you are so you dont know where the attacker is and thats why you cant block the IP. You are out of luck. 2016-08-09 18:38 GMT+02:00 Toralf Förster <toralf.foerster@gmx.de>:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Got few times an informal report containing something like:
It is most likely the attack traffic is directed at one of the following endpoints:
account.sonyentertainmentnetwork.com auth.np.ac.playstation.net auth.api.sonyentertainmentnetwork.com auth.api.np.ac.playstation.net
I was just wondering how would somebody handle a request to exclude those IP addresses, b/c 2 attempts to get the affected netwrok gives:
# host account.sonyentertainmentnetwork.com account.sonyentertainmentnetwork.com is an alias for account.sonyentertainmentnetwork.com.edgekey.net. account.sonyentertainmentnetwork.com.edgekey.net is an alias for e380.b.akamaiedge.net. e380.b.akamaiedge.net has address 104.109.72.158
# whois 104.109.72.158 | grep CIDR CIDR: 104.64.0.0/10 CIDR: 104.109.64.0/20
and at another system :
~/devel/wireshark $ host account.sonyentertainmentnetwork.com account.sonyentertainmentnetwork.com is an alias for account.sonyentertainmentnetwork.com.edgekey.net. account.sonyentertainmentnetwork.com.edgekey.net is an alias for e380.b.akamaiedge.net. e380.b.akamaiedge.net has address 184.24.193.168
$ whois 184.24.193.168 | grep CIDR CIDR: 184.24.0.0/13 CIDR: 184.24.192.0/20
- -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2
iF4EAREIAAYFAleqBwUACgkQxOrN3gB26U7YXQD+PHgO8nVRo01abzdu1P7zC6TZ gDMkb+L51zt/k7hBJOsA/0czdSd8p8AnINKx+FP2Gi5ZSjVzzBuUM9o+htw5BdIX =Tz+I -----END PGP SIGNATURE----- _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
You could probably enumerate most (if not all) of the subnets for Akamai or CloudFlare or $InsertCDN, but blocking all of them seems like it would be terrible for Tor users since they host so much of the web at this point. So yeah... I think you're out of luck.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 08/13/2016 09:10 AM, yl wrote:
Let them block your exit, if they are consequent and block all tor they get what they want. I guess. Yes, give that answer 2 times to the origin of the abuse letter ...
- -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAleu10wACgkQxOrN3gB26U5kewD8CzN519I2XFOOnLPJnpPnwoEA HanUyxuYFXyWf/ip1EwA/j3IqDBNQBUQkOiSuF3n2VRDi5fKaBqKDoqE+rDtiJAi =N0Fe -----END PGP SIGNATURE-----
Am 13.08.2016 um 09:16 schrieb Toralf Förster:
Yes, give that answer 2 times to the origin of the abuse letter ...
Well for the abuse letters I give a different answer of course. I explain them it is a Tor Exit and also tell them that I can blacklist the one IP but that it then will just be another exit node. That is the short version, I always provide the same explanation. yl
participants (4)
-
Green Dream -
Markus Koch -
Toralf Förster -
yl