topic Re: Block Cyberghost IPs in General Topics

Block Cyberghost IPs

Sjoerd — Tue, 17 Oct 2017 09:44:20 GMT

I see a lot of threat (thousands in a few minutes) to one of my webservers from IP 176.10.115.140.

This IP belongs to cyberghost, so probably someone used this to hide his own IP and attack our webserver.

Is there a way to block this traffic (before the threat prevention blocks it)?

I know I can try to block this ip (or even the scope), but when someone on the outside tries to hide his IP address when reaching my server, his intensions are probably no good. I would like to block everyone “entering” my network who is trying to hide its IP. Is there some kind of “external dynamic list” which can help me accomplish this?

Re: Block Cyberghost IPs

BPry — Tue, 17 Oct 2017 20:59:20 GMT

@Sjoerd,

What you are asking for is essentially blocking access to every single VPN or Proxy provider, that's not a very viable solution. You might want to take a look at DoS profiles and Zone Protection limits and setup a DoS profile for the IP address that is getting hit. There really isn't a viable solution to blocking every single outside provider that someone could use to hide their IP, not to mention even if you identified the true source IP it wouldn't matter since your firewall sees the traffic coming from the listed source.

Most of these types of attacks are not truly targeted, and you just got caught up in someones scripted attack. Try blocking the IP your see the traffic coming from and see if the IP changes, generally it would not.

Re: Block Cyberghost IPs

OtakarKlier — Thu, 19 Oct 2017 22:01:03 GMT

Hello,

There are dynamic lists that are publically available. Here are a few links to help out. However I think ou are looking for something that @BPry suggested and that is a dynamic block. We have ours set to 3600 (seconds) so at least the attacker is blocked for one hour at a time.

Source on PAN support:

https://live.paloaltonetworks.com/message/54183#54183

Sans notes on this:

https://isc.sans.edu/forums/diary/Subscribing+to+the+DShield+Top+20+on+a+Palo+Alto+Networks+Firewall/19365/

Others listed on this site:

http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt

http://malc0de.com/bl/IP_Blacklist.txt

http://panwdbl.appspot.com/lists/openbl.txt

http://panwdbl.appspot.com/

http://cinsscore.com/list/ci-badguys.txt

Cheers!