{"id":99147,"date":"2021-02-16T16:22:36","date_gmt":"2021-02-16T14:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skanirovnie-portov-privelo-k-blokirovke-podseti-provajderom-iz-za-popadaniya-v-spisok-uceprotect"},"modified":"2021-02-16T16:22:36","modified_gmt":"2021-02-16T14:22:36","slug":"skanirovnie-portov-privelo-k-blokirovke-podseti-provajderom-iz-za-popadaniya-v-spisok-uceprotect","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/skanirovnie-portov-privelo-k-blokirovke-podseti-provajderom-iz-za-popadaniya-v-spisok-uceprotect","title":{"rendered":"Portscanning led to the provider blocking the subnet due to being listed on UCEPROTECT","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vincent Canfield, administrator of the mail service and hosting reseller cock.li, discovered that his entire IP network was automatically listed in the DNSBL UCEPROTECT due to port scanning from neighboring virtual machines. Vincent's subnet was placed on Level 3, where blocking occurs based on Autonomous System numbers and encompasses entire subnets that have repeatedly triggered spam detection for different addresses. As a result, the provider M247 disabled the announcement of one of his networks in BGP, effectively suspending service. <\/p>\n

The problem is that the proxies servrar<\/a> UCEPROTECT, which pretends to be open relays and logs attempts to send mail through them, automatically adds addresses to the blocklist based on any network activity, without verifying the establishment of the network connection. A similar method of blacklisting is also employed by the Spamhaus project. <\/p>\n

To get on the blocklist, it is enough to send one TCP SYN packet, which could be exploited by malicious actors. In particular, since two-way confirmation of the TCP connection is not required, it is possible to spoof and send a packet indicating a fake IP-adresser<\/a> and initiate the blocking of any host. By simulating activity from multiple addresses, it is possible to escalate the block to Levels 2 and 3, which perform blocking by subnets and Autonomous System numbers. <\/p>\n

Level 3 was originally created to combat providers that encourage malicious activity by clients and do not respond to complaints (for example, hosting services specifically created for hosting illegal content or servicing spammers). A few days ago, UCEPROTECT changed the rules for being listed on Levels 2 and 3, leading to more aggressive filtering and an increase in the size of the lists. For instance, the number of entries in the Level 3 list grew from 28 to 843 Autonomous Systems. <\/p>\n

F\u00f6r att motverka UCEPROTECT har id\u00e9n om att anv\u00e4nda spoofing av adresser vid skanning med IP-adresser fr\u00e5n UCEPROTECT:s sponsorer f\u00f6reslagits. I slut\u00e4ndan inkluderade UCEPROTECT adresser fr\u00e5n sina sponsorer och m\u00e5nga andra oskyldiga i sina databaser, vilket skapade problem med leveransen av e-post. Bland annat hamnade CDN-n\u00e4tverket f\u00f6r f\u00f6retaget Sucuri p\u00e5 blocklistan.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0438\u043d\u0441\u0435\u043d\u0442 \u041a\u044d\u043d\u0444\u0438\u043b\u0434 (Vincent Canfield), \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0438 \u0445\u043e\u0441\u0442\u0438\u043d\u0433\u0430-\u0440\u0435\u0441\u0435\u043b\u043b\u0435\u0440\u0430 cock.li, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b, \u0447\u0442\u043e \u0432\u0441\u044e \u0435\u0433\u043e IP-\u0441\u0435\u0442\u044c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u043d\u0435\u0441\u043b\u0438 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a DNSBL UCEPROTECT \u0437\u0430 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0440\u0442\u043e\u0432 \u0441 \u0441\u043e\u0441\u0435\u0434\u043d\u0438\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d. \u041f\u043e\u0434\u0441\u0435\u0442\u044c \u0412\u0438\u043d\u0441\u0435\u043d\u0442\u0430 \u043f\u043e\u043f\u0430\u043b\u0430 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a Level 3, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u043d\u043e\u043c\u0435\u0440\u0430\u043c \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0446\u0435\u043b\u044b\u0435 \u043f\u043e\u0434\u0441\u0435\u0442\u0438, \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043d\u043e\u0433\u043e\u043a\u0440\u0430\u0442\u043d\u043e \u0438 \u0434\u043b\u044f \u0440\u0430\u0437\u043d\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99147","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Portskanning ledde till blockering av deln\u00e4tet av leverant\u00f6ren p\u00e5 grund av att det hamnade p\u00e5 UCEPROTECT-listan | ProHoster","description":"Vincent Canfield, administrat\u00f6r f\u00f6r e-posttj\u00e4nsten och hosting\u00e5terf\u00f6rs\u00e4ljaren cock.li, uppt\u00e4ckte att hela hans IP-n\u00e4tverk automatiskt hade lagts till i DNSBL UCEPROTECT p\u00e5 grund av portskanning fr\u00e5n grannarna.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/skanirovnie-portov-privelo-k-blokirovke-podseti-provajderom-iz-za-popadaniya-v-spisok-uceprotect","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u043d\u0438\u0435 \u043f\u043e\u0440\u0442\u043e\u0432 \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0435 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u043c \u0438\u0437-\u0437\u0430 \u043f\u043e\u043f\u0430\u0434\u0430\u043d\u0438\u044f \u0432 \u0441\u043f\u0438\u0441\u043e\u043a UCEPROTECT | ProHoster","og:description":"\u0412\u0438\u043d\u0441\u0435\u043d\u0442 \u041a\u044d\u043d\u0444\u0438\u043b\u0434 (Vincent Canfield), \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0438 \u0445\u043e\u0441\u0442\u0438\u043d\u0433\u0430-\u0440\u0435\u0441\u0435\u043b\u043b\u0435\u0440\u0430 cock.li, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b, \u0447\u0442\u043e \u0432\u0441\u044e \u0435\u0433\u043e IP-\u0441\u0435\u0442\u044c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u043d\u0435\u0441\u043b\u0438 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a DNSBL UCEPROTECT \u0437\u0430 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0440\u0442\u043e\u0432 \u0441 \u0441\u043e\u0441\u0435\u0434\u043d\u0438\u0445.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/skanirovnie-portov-privelo-k-blokirovke-podseti-provajderom-iz-za-popadaniya-v-spisok-uceprotect","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-02-16T14:22:36+00:00","article:modified_time":"2021-02-16T14:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99147","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 09:54:35","updated":"2026-02-09 16:53:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/99147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=99147"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/99147\/revisions"}],"predecessor-version":[{"id":159158,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/99147\/revisions\/159158"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=99147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=99147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=99147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}