URGENT - Block This IP!

[MasterXBKC]

This is an urgent one for those running opnsense firewalls.

Block 163.172.112.193

It has scanned my IP space before(i have a lot), but mostly passively, then moves on to others, BUT today when it crossed my IP Space and found the new OPNSense i have up and running for development and testing for PFMonitor, it suddenly began brute forcing like crazy against SSH, The Web Config, and OpenVPN all simultaneously and rapidly.  When it ran into my pfSense unit it tried a few passwords then gave up, but the OPNSense it strangely targetted quite heavily and continuously for a while.

I Also have a Dell IDRAC6 Honeypot up and running and it hit that a few times as well, i log all of this of course to see what nasties are out and about scanning my territory online.

Just a safety warning.  Block that IP!

[chemlud]

French NSA? :-D

[weust]

You have SSH, WebConfig and IDRAC Honeypot open to the internet?

[MasterXBKC]

You have SSH, WebConfig and IDRAC Honeypot open to the internet?

And many others as well.  Im a cyber security engineer.  I also work with AZCWR ( http://azcwr.org )

[weust]

Alright, that makes sense :-)