Skynet 185.200.118.0/24 ban range - OpenVPN server intrusion attempts

[kernol]

Just curious ... my openvpn.log includes daily attempts from random ip's within the above range.
Some of the ip's used [like the most recent 185.200.118.83] are in the skynet blacklist - while others are not - so I opted to "ban" the entire range.
Despite being in the skynet blacklist - the ip address mentioned was not blocked by skynet - but the login attempt failed anyway.

Anyone else being hit by the range mentioned?

 

[AndreiV]

I saw your reports on Abuse IPBD just now , that IP was auto banned by TURRIS a few days ago. I have seen it in the mini pot and honeypot this morning trying multiple credential attacks.

This one 80.243.181.81 needs watching, 223 attempts on SSH in the honey pot so far today.

 

[JaimeZX]

Negative on any of my routers, thanks for pointing it out.

 

[ColinTaylor]

I had been blocking that range. But moving the OpenVPN server to a non-standard port solves the problem without requiring any scripts.

AC3100 / 380.70 Block incoming IP

I am getting frequent incoming connection attempts to connect to my OVPN server from 185.200.118.0/24 . I do have certificate security setup so it should be fairly secure but I would like to eliminate it completely. I have found several relatively complex posts with scripts to address similar...

www.snbforums.com

 

[kernol]

I had been blocking that range. But moving the OpenVPN server to a non-standard port solves the problem without requiring any scripts.

AC3100 / 380.70 Block incoming IP

I am getting frequent incoming connection attempts to connect to my OVPN server from 185.200.118.0/24 . I do have certificate security setup so it should be fairly secure but I would like to eliminate it completely. I have found several relatively complex posts with scripts to address similar...

www.snbforums.com

Thanks Colin - always best to use non-standard ports I guess ... so thanks for that reminder .
ISP should action - offender not just port scanning ... definitely trying to intrude !

 

[CaptainSTX]

Just curious ... my openvpn.log includes daily attempts from random ip's within the above range.
Some of the ip's used [like the most recent 185.200.118.83] are in the skynet blacklist - while others are not - so I opted to "ban" the entire range.
Despite being in the skynet blacklist - the ip address mentioned was not blocked by skynet - but the login attempt failed anyway.

Anyone else being hit by the range mentioned?

Nothing in my logs from that IP or range.

Only one attempt on the port my server is using.

 

[octopus]

Just curious ... my openvpn.log includes daily attempts from random ip's within the above range.
Some of the ip's used [like the most recent 185.200.118.83] are in the skynet blacklist - while others are not - so I opted to "ban" the entire range.
Despite being in the skynet blacklist - the ip address mentioned was not blocked by skynet - but the login attempt failed anyway.

Anyone else being hit by the range mentioned?

I get some hits to:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
79 3190 DROP all -- eth0 any no-mans-land.m247.com/24 anywhere