I see i am getting a shit load of scans on my router, and the IPs check
back to Censys Inc

They seem to doing some "research".

https://support.censys.io/hc/en-us/articles/360038762031-What-does-Censys-scan-

What does the font know of it?

--
Bruce Porter
"The internet is a huge and diverse community but mainly friendly"
https://the-ytc1-shed.blogspot.com/ Deprected(http://ytc1.blogspot.co.uk/)
There *is* an alternative! https://www.libreoffice.org/

In article <sj77cp$6tv$1@dont-email.me>, YTC#1 says...
>
> I see i am getting a shit load of scans on my router, and the IPs check
> back to Censys Inc
>
> They seem to doing some "research".
>
> https://support.censys.io/hc/en-us/articles/360038762031-What-does-Censys-scan-
>
> What does the font know of it?

https://support.censys.io/hc/en-us/articles/360043177092-
Opt-Out-of-Scanning

On 01/10/2021 16:19, petrolcan wrote:
> In article <sj77cp$6tv$1@dont-email.me>, YTC#1 says...
>>
>> I see i am getting a shit load of scans on my router, and the IPs check
>> back to Censys Inc
>>
>> They seem to doing some "research".
>>
>> https://support.censys.io/hc/en-us/articles/360038762031-What-does-Censys-scan-
>>
>> What does the font know of it?
>
> https://support.censys.io/hc/en-us/articles/360043177092-
> Opt-Out-of-Scanning
>

yes, saw that. Not seeing a FW option to block on my router.

I suppose it is more annoying than anything else, as it fills the logs ....

--
Bruce Porter
"The internet is a huge and diverse community but mainly friendly"
https://the-ytc1-shed.blogspot.com/ Deprected(http://ytc1.blogspot.co.uk/)
There *is* an alternative! https://www.libreoffice.org/

In article <sj7cs4$iro$1@dont-email.me>, YTC#1 says...
>
> On 01/10/2021 16:19, petrolcan wrote:
> > In article <sj77cp$6tv$1@dont-email.me>, YTC#1 says...
> >>
> >> I see i am getting a shit load of scans on my router, and the IPs check
> >> back to Censys Inc
> >>
> >> They seem to doing some "research".
> >>
> >> https://support.censys.io/hc/en-us/articles/360038762031-What-does-Censys-scan-
> >>
> >> What does the font know of it?
> >
> > https://support.censys.io/hc/en-us/articles/360043177092-
> > Opt-Out-of-Scanning
> >
>
> yes, saw that. Not seeing a FW option to block on my router.
>
> I suppose it is more annoying than anything else, as it fills the logs ....

Pihole then

On Fri, 1 Oct 2021 17:26:44 +0100, YTC#1
<bdporter@ytc1-removespam.co.uk> wrote:

>On 01/10/2021 16:19, petrolcan wrote:
>> In article <sj77cp$6tv$1@dont-email.me>, YTC#1 says...
>>>
>>> I see i am getting a shit load of scans on my router, and the IPs check
>>> back to Censys Inc
>>>
>>> They seem to doing some "research".
>>>
>>> https://support.censys.io/hc/en-us/articles/360038762031-What-does-Censys-scan-
>>>
>>> What does the font know of it?
>>
>> https://support.censys.io/hc/en-us/articles/360043177092-
>> Opt-Out-of-Scanning
>>
>
>yes, saw that. Not seeing a FW option to block on my router.
>
>I suppose it is more annoying than anything else, as it fills the logs ....

Do you run any services behind the firewall? If not then you may be
able to just configure the logging to not bother recording any failed
connects - they are dross, of no impact or importance, and only serve
to hide any actual data of interest. It's impressive that you even get
to identify these in the midst of everything else likely to be
attempting access.

If generic probes are of concern then maybe restrict things to looking
at the total number of daily attempts, and follow up on any
significant deviations from the norm. Otherwise you could end up
going down the rabbit hole of innumerable and almost certainly
irrelevant traces.

--

Pete
Garage vacancy now filled, N+1 incremented accordingly
F800R

On Friday, October 1, 2021 at 3:53:14 PM UTC+1, YTC#1 wrote:
> I see i am getting a shit load of scans on my router, and the IPs check
> back to Censys Inc
>
> They seem to doing some "research".
>
> https://support.censys.io/hc/en-us/articles/360038762031-What-does-Censys-scan-
>
> What does the font know of it?

It's not so bad until they upgrade to Censys Anal Probing. Apparently...

--
WUN

On 01/10/2021 22:48, Pete wrote:
> On Fri, 1 Oct 2021 17:26:44 +0100, YTC#1
> <bdporter@ytc1-removespam.co.uk> wrote:
>
>> On 01/10/2021 16:19, petrolcan wrote:
>>> In article <sj77cp$6tv$1@dont-email.me>, YTC#1 says...
>>>>
>>>> I see i am getting a shit load of scans on my router, and the IPs check
>>>> back to Censys Inc
>>>>
>>>> They seem to doing some "research".
>>>>
>>>> https://support.censys.io/hc/en-us/articles/360038762031-What-does-Censys-scan-
>>>>
>>>> What does the font know of it?
>>>
>>> https://support.censys.io/hc/en-us/articles/360043177092-
>>> Opt-Out-of-Scanning
>>>
>>
>> yes, saw that. Not seeing a FW option to block on my router.
>>
>> I suppose it is more annoying than anything else, as it fills the logs ....
>
> Do you run any services behind the firewall? If not then you may be

Yep, Secure Global Desktop, 3 Nextclouds and 3 FAQs (plus lots of
internal stuff I play with)

But I think the issue here is that I don't have a separate FW function
on the netgear router (R6350). My VM router is in modem mode and then
everythng else goes via the netgear.

I can block stuff going out, but unless I am misreading stuff (highly
likely) I can't block stuff coming in.

Maybe I need to upgrade.

> able to just configure the logging to not bother recording any failed
> connects - they are dross, of no impact or importance, and only serve
> to hide any actual data of interest. It's impressive that you even get
> to identify these in the midst of everything else likely to be
> attempting access.
>
> If generic probes are of concern then maybe restrict things to looking
> at the total number of daily attempts, and follow up on any
> significant deviations from the norm. Otherwise you could end up
> going down the rabbit hole of innumerable and almost certainly
> irrelevant traces.
>

This isn't an enterprise class setup you know :-)

--
Bruce Porter
"The internet is a huge and diverse community but mainly friendly"
https://the-ytc1-shed.blogspot.com/ Deprected(http://ytc1.blogspot.co.uk/)
There *is* an alternative! https://www.libreoffice.org/

On Sat, 2 Oct 2021 11:37:51 +0100, YTC#1
<bdporter@ytc1-removespam.co.uk> wrote:

>I can block stuff going out, but unless I am misreading stuff (highly
>likely) I can't block stuff coming in.

Unless you've set up specific forwarding paths then you usually don't
need to bother about blocking traffic, it's nowhere to go and will be
dropped silently (as far as the far end is concerned). The main
exception is a DMZ, but if you're running that then you will already
be aware of the hazards. Given the Oracle stuff (is that SGD as a
server?) then I'd assume that to be the case as well.

--

Pete
Garage vacancy now filled, N+1 incremented accordingly
F800R

On 02/10/2021 16:13, Pete wrote:
> On Sat, 2 Oct 2021 11:37:51 +0100, YTC#1
> <bdporter@ytc1-removespam.co.uk> wrote:
>
>> I can block stuff going out, but unless I am misreading stuff (highly
>> likely) I can't block stuff coming in.
>
> Unless you've set up specific forwarding paths then you usually don't
Port forwarding only

> need to bother about blocking traffic, it's nowhere to go and will be
> dropped silently (as far as the far end is concerned). The main
> exception is a DMZ, but if you're running that then you will already
> be aware of the hazards. Given the Oracle stuff (is that SGD as a

A Solars zone, acting as a server. Gives me a full remote desktop.
Yes, I know there are other solutions, but as it runs in a zone I have
an extra level of security.

And I know that nothing is secure, not even if you cover it in concrete
and dump it in the ocean.

> server?) then I'd assume that to be the case as well.
>

--
Bruce Porter
"The internet is a huge and diverse community but mainly friendly"
https://the-ytc1-shed.blogspot.com/ Deprected(http://ytc1.blogspot.co.uk/)
There *is* an alternative! https://www.libreoffice.org/