Nice big old port scan. Brand new server too. Just a few days old so there is nothing to find. Don’t worry I contacted AWS. Stay safe out there.

  • Scrubbles@poptalk.scrubbles.tech
    link
    fedilink
    English
    arrow-up
    61
    ·
    2 days ago

    Uh sorry dude, but no this isn’t a script kiddy, these are bots that scan every IP address every day for any open ports, it’s a constant thing. If you have a public IP, you have people, govs, nefarious groups scanning it. AWS will tell you the same as if you were hosting it locally, close up the ports, put it on a private network. Use a vpc and WAF in AWS’ case.

    I get scanned constantly. Every hour of every day dark forced attempt to penetrate our defences.

    • MightBeFluffy@pawb.socialOP
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      59
      ·
      2 days ago

      Not on AWS and yes I know I can’t stop port scanning and bad traffic is a thing. Doesn’t stop me from filling out the form. I think to piss off you and the other commenters, I’ll write a script to auto fill out AWS abuse forms. Also script kiddy or bot, all the same to me, their hosting provider is getting a message from me

      • Reggie@discuss.tchncs.de
        link
        fedilink
        English
        arrow-up
        10
        arrow-down
        1
        ·
        edit-2
        18 hours ago

        I’ll write a script to auto fill out AWS abuse forms Sounds like you are the script kiddie here

      • remotelove@lemmy.ca
        link
        fedilink
        English
        arrow-up
        23
        ·
        1 day ago

        Good luck with that, I suppose. Botnets can have thousands, if not hundreds of thousands of infected hosts that will endlessly scan everything on the interwebs. Many of those infected hosts are behind NAT’s and your abuse form would be the equivalent of reporting an entire region for a single scan.

        But hey! Change the world, amirite?

        • irmadlad@lemmy.world
          link
          fedilink
          English
          arrow-up
          12
          ·
          1 day ago

          Meh. I know everyone is giving OP the piss, but I used to fret about this type of stuff long time ago. LOL That became a job. Then I learned a little more and realized I wasn’t being targeted specifically by some hooded specter in a dimly lit basement emphatically announcing ‘I’m in!’, but that these were bots. Sophisticated bots tho, I’ll give them that.

          • remotelove@lemmy.ca
            link
            fedilink
            English
            arrow-up
            10
            ·
            1 day ago

            My general attitude is similar to yours. Let OP figure out that the reporting and blocking is basically just creating more noise that has to gets filtered out and bot supply is basically infinite.

            “It’s a learning experience.”

            • Scrubbles@poptalk.scrubbles.tech
              link
              fedilink
              English
              arrow-up
              8
              ·
              1 day ago

              Yeah with Amazon’s sheer size this has definitely been done before, curious what limits op is going to hit. My guess is they have a quota for submissions, and they’ll be banned from submitting tickets.

      • Scrubbles@poptalk.scrubbles.tech
        link
        fedilink
        English
        arrow-up
        11
        ·
        edit-2
        1 day ago

        I mean go for it? They literally can’t do anything, you might as well complain that fire is hot though. It’s part of being in the Internet. They provide safety gloves, via VPCs and firewalls, but if you choose not to use them then… yeah I mean youre probably gonna get burned

      • irmadlad@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 day ago

        Not on AWS and yes I know I can’t stop port scanning and bad traffic is a thing. Doesn’t stop me from filling out the form.

        On occasion, if they end up in recidive, I’ll report them to AbuseIPdb. If I did it for all attempts, I’d be as busy as a squirrel in a nut factory, because the bots are thick out in the ether. Like every minute of the day they’re out there throwing rocks at the castle wall. I had to start logrotating because logs were getting so big it was difficult to review and audit. Every so once in a while, they’ll break out the trebuchet and lob something significant, but I’ve had no breaches to date.

        My servers are single user only, so buttoning things down is a little less complicated for me.