this post was submitted on 25 Jan 2024
39 points (97.6% liked)

Mildly Infuriating

35488 readers
702 users here now

Home to all things "Mildly Infuriating" Not infuriating, not enraging. Mildly Infuriating. All posts should reflect that.

I want my day mildly ruined, not completely ruined. Please remember to refrain from reposting old content. If you post a post from reddit it is good practice to include a link and credit the OP. I'm not about stealing content!

It's just good to get something in this website for casual viewing whilst refreshing original content is added overtime.


Rules:

1. Be Respectful


Refrain from using harmful language pertaining to a protected characteristic: e.g. race, gender, sexuality, disability or religion.

Refrain from being argumentative when responding or commenting to posts/replies. Personal attacks are not welcome here.

...


2. No Illegal Content


Content that violates the law. Any post/comment found to be in breach of common law will be removed and given to the authorities if required.

That means: -No promoting violence/threats against any individuals

-No CSA content or Revenge Porn

-No sharing private/personal information (Doxxing)

...


3. No Spam


Posting the same post, no matter the intent is against the rules.

-If you have posted content, please refrain from re-posting said content within this community.

-Do not spam posts with intent to harass, annoy, bully, advertise, scam or harm this community.

-No posting Scams/Advertisements/Phishing Links/IP Grabbers

-No Bots, Bots will be banned from the community.

...


4. No Porn/ExplicitContent


-Do not post explicit content. Lemmy.World is not the instance for NSFW content.

-Do not post Gore or Shock Content.

...


5. No Enciting Harassment,Brigading, Doxxing or Witch Hunts


-Do not Brigade other Communities

-No calls to action against other communities/users within Lemmy or outside of Lemmy.

-No Witch Hunts against users/communities.

-No content that harasses members within or outside of the community.

...


6. NSFW should be behind NSFW tags.


-Content that is NSFW should be behind NSFW tags.

-Content that might be distressing should be kept behind NSFW tags.

...


7. Content should match the theme of this community.


-Content should be Mildly infuriating.

-At this time we permit content that is infuriating until an infuriating community is made available.

...


8. Reposting of Reddit content is permitted, try to credit the OC.


-Please consider crediting the OC when reposting content. A name of the user or a link to the original post is sufficient.

...

...


Also check out:

Partnered Communities:

1.Lemmy Review

2.Lemmy Be Wholesome

3.Lemmy Shitpost

4.No Stupid Questions

5.You Should Know

6.Credible Defense


Reach out to LillianVS for inclusion on the sidebar.

All communities included on the sidebar are to be made in compliance with the instance rules.

founded 1 year ago
MODERATORS
 

This is infuriating that I continue to get this repeats of nine and more possible hack attempts from the same certain IP addresses blocked by Malwarebytes, which I get popups every time it happens. This is a snapshot from my logs after one has happened, and I also save text file logs of it.

From what I can tell, they appeared to be originating from Linode almost every time and when I tried to file complaints with them, they keep claiming it is a security researcher or something and end up doing nothing about it. I'm currently wondering what to do about this as I have a folder of so many save logs of it on my computer.

all 14 comments
sorted by: hot top controversial new old
[–] [email protected] 23 points 9 months ago (1 children)

It's normal to get scans/attempts on any public IP.

That said, malwarebytes is usually run on personal computers, do you have ports forwarded to your PC from the internet?

[–] [email protected] 5 points 9 months ago (2 children)

No, I don't have any ports forwarded to my PC from the internet as far as I'm aware.

[–] [email protected] 16 points 9 months ago (2 children)

If they are making it past your firewall and hitting your computer then the firewall is open and it shouldn’t be. Or that’s an outbound connection triggering the alert.

[–] [email protected] 6 points 9 months ago* (last edited 9 months ago)

Just clarification here, a NAT is NOT a firewall. It will drop packets originating from outside the network if the ports aren't forwarded to an IP simply because the NAT has no idea which device on the network to send the packets to. A forwarded port is you telling the NAT to assume packets coming into a specific port should be forwarded to a specific device. It is acting as a security measure simply by coincidence but not by design. Unlike a firewall it will not inspect any packet payload or attempt to make a security decision on outbound packets. It only routes based on the packet headers.

A firewall on the other hand actively will reject or drop packets because it is an Intrusion Prevention System (IPS). This is why if your router has a built-in firewall, your NAT will still drop the packets -- because it isn't a firewall nor is it what is being referred to if you disable it.

[–] [email protected] 0 points 9 months ago (1 children)

It's more like an inbound connection that is triggering the alert.

[–] [email protected] 5 points 9 months ago (1 children)
  1. You are seeing the logs on your pc, if the connections are hitting your pc then your router is not doing its job correctly and you need to look into it.
  2. If you don't have a static ip set up, try rebooting your router. Most ISPs will cycle you a new IP address.
  3. I don't think this is really a hack attempt, for one, no one hacks people using their true ip, and you said you spoke to them so
[–] [email protected] 1 points 9 months ago

Well, I just went through some online instructions to setup an inbound rule in Windows Defender Firewall that is a list of IPs to have it block, hoping that will solve this ongoing problem I was having.

[–] [email protected] 4 points 9 months ago (1 children)

Hmm maybe these are outgoing traffic in that case, does it tell you the src/dst info?

[–] [email protected] 3 points 9 months ago* (last edited 9 months ago) (2 children)

Not that I can tell, this is what shows up in the logs of just one of the hack or scan attempts.

Malwarebytes www.malwarebytes.com

-Log Details- Protection Event Date: 1/2/24 Protection Event Time: 10:48 PM Log File: f150648e-a9ea-11ee-8d8b-04d4c458e8f6.json

-Software Information- Version: 4.6.7.301 Components Version: 1.0.2222 Update Package Version: 1.0.79191 License: Premium

-System Information- OS: Windows 10 (Build 19045.3803) CPU: x64 File System: NTFS User: System

-Blocked Website Details- Malicious Website: 1

-Website Data- Category: Compromised Domain: IP Address: 45.79.168.172 Port: 6667 Type: Inbound

[–] [email protected] 6 points 9 months ago

A quick search shows that IP is known for hacking type requests https://www.abuseipdb.com/check/45.79.168.172

I would check how your router is setup, as they should not be hitting your computer at all.

[–] [email protected] 1 points 9 months ago* (last edited 9 months ago)

Port 6667 is a typical IRC port. It is sometimes used by remote access backdoors for command and control via a channel (chat room basically) on an IRC server, however, if that port isn't forward OR you don't have your PC set as the DMZ Host (you should never do this), then you probably have malicious software on your system.

If it isn't forwarded, then your NAT would drop the packets and Malwarebytes would never see it because they wouldn't be there. Malicious software can forward ports via uPNP and you should turn that off on your router or router/modem combo. It can also make it through if the connection is starting from inside of your network for TCP, which is the protocol that would be used for 6667 normally.

[–] [email protected] 20 points 9 months ago

just drop the traffic and get on with your life

[–] [email protected] 6 points 9 months ago

If you don't have any of those ports open, then just ignore it. There are lots of bots out there that are just scanning for easy targets.