5

I connected my Raspberry PI model B on my internet box (at SFR in France). My box redirect all request on its port 8080 to my raspberry on its port 8080 where I have an application which listen on port 8080. To access to my raspberry application which is a website, you must type the IP adress in your web explorer or type the DTDNS adress and access on the port 8080. (myip:8080 or myadress.dtdns.net:8080) I log every connection on my raspberry and then I have this result (all IP adress is unknown for me.

My question is : What are all these connections and where do they come from? Is it bot or other thing ? If you have any explanation, I'll take it. Is there some bot that scans every port on every IP address in the world? ?

years-month-day hours:minute:seconds : IP adress call ...
2016-03-30 07:48:47 : 93.174.93.94 call GET /
2016-03-30 11:19:13 : 202.62.86.140 call HEAD /manager/html
2016-03-30 15:41:23 : 104.148.71.133 call GET http://azenv.net/
2016-03-30 15:41:23 : 104.148.71.133 call GET http://proxyworld.perso.sfr.fr/azenv.php
2016-03-30 15:41:42 : 104.148.71.133 call GET http://domkrim.com/av.php
2016-03-30 15:41:43 : 104.148.71.133 call GET http://azenv.net/
2016-03-30 15:41:43 : 104.148.71.133 call GET http://proxyworld.perso.sfr.fr/azenv.php
2016-03-30 15:42:03 : 104.148.71.133 call GET http://proxyworld.perso.sfr.fr/azenv.php
2016-03-30 20:01:28 : 210.91.40.88 call GET //script
2016-03-30 20:01:29 : 210.91.40.88 call GET //script
2016-03-30 20:01:33 : 210.91.40.88 call GET //script
2016-03-30 20:01:35 : 210.91.40.88 call GET //script
2016-03-30 20:12:00 : 93.174.93.94 call GET /

2016-03-31 02:05:25 : 93.174.93.94 call GET /
2016-03-31 02:30:48 : 104.148.71.133 call GET http://www.proxy-listen.de/azenv.php
2016-03-31 02:30:48 : 104.148.71.133 call GET http://www.proxy-listen.de/azenv.php
2016-03-31 02:31:08 : 104.148.71.133 call GET http://www.mesregies.com/azz.php
2016-03-31 02:31:08 : 104.148.71.133 call GET http://domkrim.av/.php
2016-03-31 02:31:08 : 104.148.71.133 call GET http://www.proxy-listen.de/azenv.php
2016-03-31 02:31:28 : 104.148.71.133 call GET http://www.proxyjudge.info/azenv.php

2016-03-31 08:24:50 : 222.186.34.155 call GET https://m.baidu.com/
2016-03-31 08:24:52 : 222.186.34.155 call GET https://m.baidu.com/
2016-03-31 08:24:52 : 222.186.34.155 call GET https://m.baidu.com/

2016-04-09 04:10:59 : 91.236.75.4 call GET http://www.google.com/reader/about/
2016-04-09 09:42:26 : 93.174.93.94 call GET /
2016-04-09 10:23:18 : 80.82.78.38 call GET http://www.baidu.com/cache/global/img/gs.gif
2016-04-09 10:23:19 : 80.82.78.38 call GET http://www.baidu.com/cache/global/img/gs.gif
2016-04-09 10:23:21 : 80.82.78.38 call GET http://www.baidu.com/cache/global/img/gs.gif
2016-04-09 10:23:25 : 80.82.78.38 call GET http://www.baidu.com/cache/global/img/gs.gif
2016-04-09 10:23:33 : 80.82.78.38 call GET http://www.baidu.com/cache/global/img/gs.gif
2016-04-09 10:23:49 : 80.82.78.38 call GET http://www.baidu.com/cache/global/img/gs.gif
2016-04-09 19:57:09 : 146.0.43.8 call GET /
2016-04-09 20:57:08 : 93.174.93.94 call GET /
2016-04-10 03:16:35 : 185.92.72.15 call GET /
2016-04-10 03:16:35 : 185.92.72.15 call GET /HNAP1/
2016-04-10 11:52:40 : 91.236.75.4 call GET http://www.google.com/reader/about/
dada17xs
  • 180
  • 1
  • 11
  • 3
    I don't know about these specificly, but when you run a web service, expect to get requests that are attempts to exploit security breaches on your server. – vmonteco Apr 10 '16 at 13:40
  • 2
    You (maybe) would better ask this on http://superuser.com/. You can use your http://stackoverflow.com/ account for this, linking it to this community too. Go to the site, upper right click on "join this community". The historical root of the StackExchange network, SO (StackOverflow), is for programming questions. – jbm Apr 10 '16 at 15:23
  • 1
    Insidious bots digger looking for "stuff". Anything with a potential vulnerability and potentially some reachable interesting info behind that. I monitor the logs from my OVH no-box, and in the past 3 or 4 days got 7 tcp_port_scan and 1 tcp_syn_scan. _Why/What for?_ Welcome to the real world. `Baidu` is a Chinese search engine. `domkrim.av` is suspicious according to google. **Is this special?** No. **Should you care about this?** It depends. Ex if you think about self-hosting, this may be more work than you thought, security wise. – jbm Apr 10 '16 at 16:03

1 Answers1

5

they are trying to find vulnerability in your server. I see those every day in my server.

Remember: not indexing an IP address is not an security improvement: botnets which are trying to attack users don't care about dns, but ip. It's like your home: your street and your address are public, but it's better keeping doors closed.

What i see every day are bots which make dictionary attacks on ssh and common vulnerabilities checks on 80 and 8080 ports.

Very often, bots are iot devices with upnp enabled and DEFAULT admin login unchanged. Sometimes, they are raspberry pi (and similar) with default login data.

So, the best counter-measure you can do is change default logins, disable upnp if you don't need and, if you can do, disable login for common users (like root, admin, pi, ecc)

Adding some characters before your username (like changing pi to user_pi) can help you against dictionary attacks (pre-programmed username/password combinations), but an strong password is the best. Using an localized name won't work: sometimes bots try different dictionary according to your ip location.

Marco P
  • 61
  • 1
  • 5