topic Re: question for block amazonaws in General Topics

question for block amazonaws

Bin — Tue, 08 Dec 2015 10:19:53 GMT

Hi I recently got many amazonaws.com IPs listed in my attacker list from my daily report as below. How do I block all traffic from amazonaws, and I cannot find it from my traffic monitor and why? Please give me some hints?

52.5.42.249 ec2-52-5-42-249.compute-1.amazonaws.com 10
54.85.146.141 ec2-54-85-146-141.compute-1.amazonaws.com 9
52.91.113.81 ec2-52-91-113-81.compute-1.amazonaws.com 6
52.4.179.243 ec2-52-4-179-243.compute-1.amazonaws.com 5
52.21.173.164 ec2-52-21-173-164.compute-1.amazonaws.com 5
54.84.95.2 ec2-54-84-95-2.compute-1.amazonaws.com 5
52.5.15.19 ec2-52-5-15-19.compute-1.amazonaws.com 4
54.208.13.33 ec2-54-208-13-33.compute-1.amazonaws.com 4

Re: question for block amazonaws

BenjAudy.MTL — Tue, 08 Dec 2015 15:09:53 GMT

Hi,

Amazon publishes their IP address ranges on this page:

http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#aws-ip-download

It's in JSON format so you can easily create a script that will upload the list to the firewall using the firewall API. I was planning to do just that, but haven't found the time yet.

Regards,

Benjamin

Re: question for block amazonaws

Brandon_Wertz — Thu, 10 Dec 2015 19:12:30 GMT

@Bin From this post I saw the domain compute-1.amazonaws.com was listed as "Shopping." Palo has now recently (PAN-DB) categorized this domain as "CDN" not sure if that helps you at all.