14

I'm running a dedicated server at one of the biggest hosters in Germany. This server serves the network with an Ethereum supernode, running parity 1.1.0 in archive pruning mode and allows up to 1024 peers to connect.

This morning I received an abuse message from the hoster telling me my server is compromised and attacking other servers on the network. They attached the following logs:

##########################################################################
#               Netscan detected from host     ***.***.***.148           #
##########################################################################

time                protocol src_ip src_port          dest_ip dest_port
---------------------------------------------------------------------------
Tue Jun 21 00:51:45 2016 TCP     ***.***.***.148 56820 =>    ***.***.***.170 30303
Tue Jun 21 00:51:46 2016 TCP     ***.***.***.148 56820 =>    ***.***.***.170 30303
Tue Jun 21 00:51:48 2016 TCP     ***.***.***.148 56820 =>    ***.***.***.170 30303
Tue Jun 21 00:51:52 2016 TCP     ***.***.***.148 56820 =>    ***.***.***.170 30303
Tue Jun 21 00:53:46 2016 TCP     ***.***.***.148 52654 =>    ***.***.***.21 30303
Tue Jun 21 00:53:47 2016 TCP     ***.***.***.148 52654 =>    ***.***.***.21 30303
Tue Jun 21 00:56:52 2016 TCP     ***.***.***.148 47412 =>      ***.***.***.2 30303
Tue Jun 21 00:56:53 2016 TCP     ***.***.***.148 47412 =>      ***.***.***.2 30303
Tue Jun 21 00:56:55 2016 TCP     ***.***.***.148 47412 =>      ***.***.***.2 30303
Tue Jun 21 00:49:19 2016 TCP     ***.***.***.148 35120 =>     ***.***.***.85 30303
Tue Jun 21 00:49:20 2016 TCP     ***.***.***.148 35120 =>     ***.***.***.85 30303
Tue Jun 21 00:49:22 2016 TCP     ***.***.***.148 35120 =>     ***.***.***.85 30303
Tue Jun 21 00:53:46 2016 TCP     ***.***.***.148 44138 =>     ***.***.***.85 30303
Tue Jun 21 00:53:47 2016 TCP     ***.***.***.148 44138 =>     ***.***.***.85 30303
Tue Jun 21 00:53:49 2016 TCP     ***.***.***.148 44138 =>     ***.***.***.85 30303
Tue Jun 21 00:53:53 2016 TCP     ***.***.***.148 44138 =>     ***.***.***.85 30303
Tue Jun 21 00:55:35 2016 TCP     ***.***.***.148 33240 =>    ***.***.***.11 30303
Tue Jun 21 00:52:13 2016 TCP     ***.***.***.148 37032 =>     ***.***.***.0 30303
Tue Jun 21 00:49:57 2016 TCP     ***.***.***.148 54912 =>   ***.***.***.121 30303
Tue Jun 21 00:49:57 2016 TCP     ***.***.***.148 54914 =>   ***.***.***.121 30303
Tue Jun 21 00:49:58 2016 TCP     ***.***.***.148 54914 =>   ***.***.***.121 30303
Tue Jun 21 00:49:58 2016 TCP     ***.***.***.148 54912 =>   ***.***.***.121 30303
Tue Jun 21 00:50:00 2016 TCP     ***.***.***.148 54914 =>   ***.***.***.121 30303
Tue Jun 21 00:50:00 2016 TCP     ***.***.***.148 54912 =>   ***.***.***.121 30303
Tue Jun 21 00:50:04 2016 TCP     ***.***.***.148 54912 =>   ***.***.***.121 30303
Tue Jun 21 00:50:04 2016 TCP     ***.***.***.148 54914 =>   ***.***.***.121 30303
Tue Jun 21 00:49:34 2016 TCP     ***.***.***.148 42096 =>   ***.***.***.150 30303
Tue Jun 21 00:49:19 2016 TCP     ***.***.***.148 38642 =>   ***.***.***.223 30303
Tue Jun 21 00:49:20 2016 TCP     ***.***.***.148 38642 =>   ***.***.***.223 30303
Tue Jun 21 00:49:22 2016 TCP     ***.***.***.148 38642 =>   ***.***.***.223 30303
Tue Jun 21 00:51:56 2016 TCP     ***.***.***.148 37032 =>    ***.***.***.30 30303
Tue Jun 21 00:49:56 2016 TCP     ***.***.***.148 46402 =>    ***.***.***.56 30303
Tue Jun 21 00:56:49 2016 TCP     ***.***.***.148 46702 =>    ***.***.***.25 30303
Tue Jun 21 00:56:49 2016 TCP     ***.***.***.148 46702 =>    ***.***.***.25 30303
Tue Jun 21 00:56:51 2016 TCP     ***.***.***.148 46702 =>    ***.***.***.25 30303
Tue Jun 21 00:48:29 2016 TCP     ***.***.***.148 40934 =>   ***.***.***.45 30303
Tue Jun 21 00:49:34 2016 TCP     ***.***.***.148 38622 =>  ***.***.***.219 30303
Tue Jun 21 00:49:35 2016 TCP     ***.***.***.148 38622 =>  ***.***.***.219 30303
Tue Jun 21 00:49:37 2016 TCP     ***.***.***.148 38622 =>  ***.***.***.219 30303
Tue Jun 21 00:50:54 2016 UDP     ***.***.***.148 30303 =>  ***.***.***.132 30303
Tue Jun 21 00:51:56 2016 TCP     ***.***.***.148 42490 =>   ***.***.***.96 30303
Tue Jun 21 00:52:01 2016 TCP     ***.***.***.148 47508 =>   ***.***.***.77 30303
Tue Jun 21 00:52:02 2016 TCP     ***.***.***.148 47508 =>   ***.***.***.77 30303
Tue Jun 21 00:52:04 2016 TCP     ***.***.***.148 47508 =>   ***.***.***.77 30303
Tue Jun 21 00:52:08 2016 TCP     ***.***.***.148 47508 =>   ***.***.***.77 30303
Tue Jun 21 00:53:25 2016 TCP     ***.***.***.148 52278 =>   ***.***.***.38 30303
Tue Jun 21 00:53:26 2016 TCP     ***.***.***.148 52278 =>   ***.***.***.38 30303
Tue Jun 21 00:53:28 2016 TCP     ***.***.***.148 52278 =>   ***.***.***.38 30303
Tue Jun 21 00:57:08 2016 TCP     ***.***.***.148 54806 =>  ***.***.***.135 30303
Tue Jun 21 00:57:09 2016 TCP     ***.***.***.148 54806 =>  ***.***.***.135 30303
Tue Jun 21 00:57:11 2016 TCP     ***.***.***.148 54806 =>  ***.***.***.135 30303
Tue Jun 21 00:57:15 2016 TCP     ***.***.***.148 54806 =>  ***.***.***.135 30303
Tue Jun 21 00:57:21 2016 TCP     ***.***.***.148 38038 =>   ***.***.***.67 30303
Tue Jun 21 00:49:56 2016 TCP     ***.***.***.148 36512 =>  ***.***.***.175 30303
Tue Jun 21 00:49:43 2016 TCP     ***.***.***.148 41824 =>     ***.***.***.59 30303
Tue Jun 21 00:49:44 2016 TCP     ***.***.***.148 41824 =>     ***.***.***.59 30303
Tue Jun 21 00:49:46 2016 TCP     ***.***.***.148 41824 =>     ***.***.***.59 30303
Tue Jun 21 00:49:50 2016 TCP     ***.***.***.148 41824 =>     ***.***.***.59 30303
Tue Jun 21 00:54:17 2016 TCP     ***.***.***.148 35796 =>     ***.***.***.84 30303
Tue Jun 21 00:54:18 2016 TCP     ***.***.***.148 35796 =>     ***.***.***.84 30303
Tue Jun 21 00:54:20 2016 TCP     ***.***.***.148 35796 =>     ***.***.***.84 30303
Tue Jun 21 00:54:24 2016 TCP     ***.***.***.148 35796 =>     ***.***.***.84 30303
Tue Jun 21 00:55:51 2016 TCP     ***.***.***.148 38354 =>    ***.***.***.11 30303
Tue Jun 21 00:55:52 2016 TCP     ***.***.***.148 38354 =>    ***.***.***.11 30303
Tue Jun 21 00:55:54 2016 TCP     ***.***.***.148 38354 =>    ***.***.***.11 30303
Tue Jun 21 00:55:58 2016 TCP     ***.***.***.148 38354 =>    ***.***.***.11 30303
Tue Jun 21 00:56:47 2016 TCP     ***.***.***.148 54600 =>    ***.***.***.49 30303
Tue Jun 21 00:56:48 2016 TCP     ***.***.***.148 54600 =>    ***.***.***.49 30303
Tue Jun 21 00:56:50 2016 TCP     ***.***.***.148 54600 =>    ***.***.***.49 30303
Tue Jun 21 00:49:37 2016 TCP     ***.***.***.148 56720 =>  ***.***.***.156 30303
Tue Jun 21 00:49:38 2016 TCP     ***.***.***.148 56720 =>  ***.***.***.156 30303
Tue Jun 21 00:49:40 2016 TCP     ***.***.***.148 56720 =>  ***.***.***.156 30303
Tue Jun 21 00:49:37 2016 TCP     ***.***.***.148 56800 =>  ***.***.***.151 30303
Tue Jun 21 00:49:13 2016 TCP     ***.***.***.148 35442 =>  ***.***.***.239 30303
Tue Jun 21 00:49:14 2016 TCP     ***.***.***.148 35442 =>  ***.***.***.239 30303
Tue Jun 21 00:49:16 2016 TCP     ***.***.***.148 35442 =>  ***.***.***.239 30303
Tue Jun 21 00:53:14 2016 TCP     ***.***.***.148 38818 =>   ***.***.***.52 30303
Tue Jun 21 00:53:15 2016 TCP     ***.***.***.148 38818 =>   ***.***.***.52 30303
Tue Jun 21 00:53:17 2016 TCP     ***.***.***.148 38818 =>   ***.***.***.52 30303
Tue Jun 21 00:50:51 2016 TCP     ***.***.***.148 56164 =>   ***.***.***.89 30303
Tue Jun 21 00:50:51 2016 TCP     ***.***.***.148 56192 =>   ***.***.***.89 30303
Tue Jun 21 00:50:52 2016 TCP     ***.***.***.148 56192 =>   ***.***.***.89 30303
Tue Jun 21 00:50:54 2016 TCP     ***.***.***.148 56192 =>   ***.***.***.89 30303
Tue Jun 21 00:50:24 2016 TCP     ***.***.***.148 56230 =>   ***.***.***.101 30303
Tue Jun 21 00:52:26 2016 TCP     ***.***.***.148 33614 =>   ***.***.***.233 30303
Tue Jun 21 00:52:26 2016 TCP     ***.***.***.148 33638 =>   ***.***.***.233 30303
Tue Jun 21 00:53:21 2016 TCP     ***.***.***.148 50490 =>   ***.***.***.244 30303
Tue Jun 21 00:53:22 2016 TCP     ***.***.***.148 50490 =>   ***.***.***.244 30303
Tue Jun 21 00:53:24 2016 TCP     ***.***.***.148 50490 =>   ***.***.***.244 30303
Tue Jun 21 00:48:57 2016 TCP     ***.***.***.148 45702 =>   ***.***.***.167 30303
Tue Jun 21 00:48:58 2016 TCP     ***.***.***.148 45702 =>   ***.***.***.167 30303
Tue Jun 21 00:49:00 2016 TCP     ***.***.***.148 45702 =>   ***.***.***.167 30303
Tue Jun 21 00:49:04 2016 TCP     ***.***.***.148 45702 =>   ***.***.***.167 30303
Tue Jun 21 00:49:12 2016 TCP     ***.***.***.148 45702 =>   ***.***.***.167 30303
Tue Jun 21 00:54:16 2016 TCP     ***.***.***.148 53074 =>  ***.***.***.175 30303
Tue Jun 21 00:49:19 2016 TCP     ***.***.***.148 44930 =>  ***.***.***.175 30303
Tue Jun 21 00:55:30 2016 TCP     ***.***.***.148 48752 =>  ***.***.***.223 30303
Tue Jun 21 00:55:31 2016 TCP     ***.***.***.148 48752 =>  ***.***.***.223 30303
Tue Jun 21 00:56:33 2016 UDP     ***.***.***.148 30303 =>  ***.***.***.223 30303
Tue Jun 21 00:48:25 2016 TCP     ***.***.***.148 41756 =>   ***.***.***.81 30303
Tue Jun 21 00:57:48 2016 TCP     ***.***.***.148 40514 =>   ***.***.***.160 30303
Tue Jun 21 00:57:49 2016 TCP     ***.***.***.148 40514 =>   ***.***.***.160 30303
Tue Jun 21 00:57:51 2016 TCP     ***.***.***.148 40514 =>   ***.***.***.160 30303
Tue Jun 21 00:49:57 2016 TCP     ***.***.***.148 47766 =>   ***.***.***.165 30303
Tue Jun 21 00:49:57 2016 TCP     ***.***.***.148 47764 =>   ***.***.***.165 30303
Tue Jun 21 00:49:58 2016 TCP     ***.***.***.148 47764 =>   ***.***.***.165 30303
Tue Jun 21 00:49:58 2016 TCP     ***.***.***.148 47766 =>   ***.***.***.165 30303
Tue Jun 21 00:50:00 2016 TCP     ***.***.***.148 47764 =>   ***.***.***.165 30303
Tue Jun 21 00:50:00 2016 TCP     ***.***.***.148 47766 =>   ***.***.***.165 30303
Tue Jun 21 00:50:04 2016 TCP     ***.***.***.148 47764 =>   ***.***.***.165 30303
Tue Jun 21 00:50:04 2016 TCP     ***.***.***.148 47766 =>   ***.***.***.165 30303
Tue Jun 21 00:53:35 2016 TCP     ***.***.***.148 53500 =>   ***.***.***.53 30303
Tue Jun 21 00:53:36 2016 TCP     ***.***.***.148 53500 =>   ***.***.***.53 30303
Tue Jun 21 00:55:32 2016 TCP     ***.***.***.148 55956 =>   ***.***.***.46 30303
Tue Jun 21 00:55:33 2016 TCP     ***.***.***.148 55956 =>   ***.***.***.46 30303
Tue Jun 21 00:55:35 2016 TCP     ***.***.***.148 55956 =>   ***.***.***.46 30303
Tue Jun 21 00:51:18 2016 UDP     ***.***.***.148 30303 =>  ***.***.***.110 30303
Tue Jun 21 00:53:33 2016 TCP     ***.***.***.148 48314 =>   ***.***.***.96 30303
Tue Jun 21 00:51:41 2016 TCP     ***.***.***.148 38252 =>     ***.***.***.50 30303
Tue Jun 21 00:51:42 2016 TCP     ***.***.***.148 38252 =>     ***.***.***.50 30303
Tue Jun 21 00:51:44 2016 TCP     ***.***.***.148 38252 =>     ***.***.***.50 30303
Tue Jun 21 00:51:54 2016 TCP     ***.***.***.148 34060 =>    ***.***.***.226 30303
Tue Jun 21 00:51:55 2016 TCP     ***.***.***.148 34060 =>    ***.***.***.226 30303
Tue Jun 21 00:52:01 2016 TCP     ***.***.***.148 57472 =>   ***.***.***.194 30303
Tue Jun 21 00:57:21 2016 TCP     ***.***.***.148 53174 =>   ***.***.***.79 30303
Tue Jun 21 00:57:22 2016 TCP     ***.***.***.148 53174 =>   ***.***.***.79 30303
Tue Jun 21 00:57:24 2016 TCP     ***.***.***.148 51610 =>    ***.***.***.1 30303
Tue Jun 21 00:57:25 2016 TCP     ***.***.***.148 51610 =>    ***.***.***.1 30303
Tue Jun 21 00:57:27 2016 TCP     ***.***.***.148 51610 =>    ***.***.***.1 30303
Tue Jun 21 00:53:04 2016 TCP     ***.***.***.148 43438 =>   ***.***.***.45 30303
Tue Jun 21 00:53:05 2016 TCP     ***.***.***.148 43438 =>   ***.***.***.45 30303
Tue Jun 21 00:53:07 2016 TCP     ***.***.***.148 43438 =>   ***.***.***.45 30303
Tue Jun 21 00:52:26 2016 TCP     ***.***.***.148 35582 =>    ***.***.***.56 30303
Tue Jun 21 00:52:26 2016 TCP     ***.***.***.148 35600 =>    ***.***.***.56 30303
Tue Jun 21 00:53:33 2016 TCP     ***.***.***.148 51714 =>   ***.***.***.241 30303
Tue Jun 21 00:53:34 2016 TCP     ***.***.***.148 51714 =>   ***.***.***.241 30303
Tue Jun 21 00:53:36 2016 TCP     ***.***.***.148 51714 =>   ***.***.***.241 30303
Tue Jun 21 00:48:56 2016 TCP     ***.***.***.148 37152 =>   ***.***.***.84 30303
Tue Jun 21 00:48:57 2016 TCP     ***.***.***.148 37152 =>   ***.***.***.84 30303
Tue Jun 21 00:48:59 2016 TCP     ***.***.***.148 37152 =>   ***.***.***.84 30303
Tue Jun 21 00:49:03 2016 TCP     ***.***.***.148 37152 =>   ***.***.***.84 30303
Tue Jun 21 00:49:11 2016 TCP     ***.***.***.148 37152 =>   ***.***.***.84 30303
Tue Jun 21 00:48:41 2016 TCP     ***.***.***.148 57928 =>    ***.***.***.65 30303
Tue Jun 21 00:48:42 2016 TCP     ***.***.***.148 57928 =>    ***.***.***.65 30303
Tue Jun 21 00:48:44 2016 TCP     ***.***.***.148 57928 =>    ***.***.***.65 30303
Tue Jun 21 00:53:35 2016 TCP     ***.***.***.148 47064 =>    ***.***.***.23 30303
Tue Jun 21 00:53:36 2016 TCP     ***.***.***.148 47064 =>    ***.***.***.23 30303
Tue Jun 21 00:53:38 2016 TCP     ***.***.***.148 47064 =>    ***.***.***.23 30303
Tue Jun 21 00:57:42 2016 UDP     ***.***.***.148 30303 =>  ***.***.***.241 30303
Tue Jun 21 00:53:02 2016 UDP     ***.***.***.148 30303 =>  ***.***.***.247 30303
Tue Jun 21 00:56:46 2016 TCP     ***.***.***.148 55368 =>   ***.***.***.24 30303
Tue Jun 21 00:56:47 2016 TCP     ***.***.***.148 55368 =>   ***.***.***.24 30303
Tue Jun 21 00:56:49 2016 TCP     ***.***.***.148 55368 =>   ***.***.***.24 30303
Tue Jun 21 00:55:25 2016 TCP     ***.***.***.148 39656 =>   ***.***.***.65 30303
Tue Jun 21 00:55:26 2016 TCP     ***.***.***.148 39656 =>   ***.***.***.65 30303
Tue Jun 21 00:55:28 2016 TCP     ***.***.***.148 39656 =>   ***.***.***.65 30303
Tue Jun 21 00:51:57 2016 TCP     ***.***.***.148 53340 =>  ***.***.***.151 30303
Tue Jun 21 00:51:58 2016 TCP     ***.***.***.148 53340 =>  ***.***.***.151 30303
Tue Jun 21 00:52:00 2016 TCP     ***.***.***.148 53340 =>  ***.***.***.151 30303
Tue Jun 21 00:52:04 2016 TCP     ***.***.***.148 53340 =>  ***.***.***.151 30303
Tue Jun 21 00:52:12 2016 TCP     ***.***.***.148 53340 =>  ***.***.***.151 30303
Tue Jun 21 00:54:29 2016 TCP     ***.***.***.148 55012 =>   ***.***.***.137 30303
Tue Jun 21 00:54:29 2016 TCP     ***.***.***.148 55040 =>   ***.***.***.137 30303
Tue Jun 21 00:55:35 2016 TCP     ***.***.***.148 44086 =>   ***.***.***.177 30303
Tue Jun 21 00:49:40 2016 TCP     ***.***.***.148 36910 =>  ***.***.***.209 30303
Tue Jun 21 00:49:41 2016 TCP     ***.***.***.148 36910 =>  ***.***.***.209 30303
Tue Jun 21 00:49:43 2016 TCP     ***.***.***.148 36910 =>  ***.***.***.209 30303
Tue Jun 21 00:57:29 2016 TCP     ***.***.***.148 39322 =>    ***.***.***.195 30303
Tue Jun 21 00:57:30 2016 TCP     ***.***.***.148 39322 =>    ***.***.***.195 30303
Tue Jun 21 00:57:32 2016 TCP     ***.***.***.148 39322 =>    ***.***.***.195 30303
Tue Jun 21 00:49:19 2016 TCP     ***.***.***.148 56584 =>    ***.***.***.17 30303
Tue Jun 21 00:49:20 2016 TCP     ***.***.***.148 56584 =>    ***.***.***.17 30303
Tue Jun 21 00:49:22 2016 TCP     ***.***.***.148 56584 =>    ***.***.***.17 30303
Tue Jun 21 00:49:23 2016 TCP     ***.***.***.148 56710 =>    ***.***.***.17 30303
Tue Jun 21 00:49:24 2016 TCP     ***.***.***.148 56710 =>    ***.***.***.17 30303
Tue Jun 21 00:49:26 2016 TCP     ***.***.***.148 56710 =>    ***.***.***.17 30303
Tue Jun 21 00:49:30 2016 TCP     ***.***.***.148 56710 =>    ***.***.***.17 30303
Tue Jun 21 00:57:24 2016 TCP     ***.***.***.148 36740 =>  ***.***.***.143 30303
Tue Jun 21 00:57:25 2016 TCP     ***.***.***.148 36740 =>  ***.***.***.143 30303
Tue Jun 21 00:57:27 2016 TCP     ***.***.***.148 36740 =>  ***.***.***.143 30303
Tue Jun 21 00:48:57 2016 TCP     ***.***.***.148 51320 =>   ***.***.***.81 30303
Tue Jun 21 00:55:00 2016 TCP     ***.***.***.148 47238 =>     ***.***.***.2 30303
Tue Jun 21 00:56:26 2016 TCP     ***.***.***.148 42130 =>   ***.***.***.51 30303
Tue Jun 21 00:56:27 2016 TCP     ***.***.***.148 42130 =>   ***.***.***.51 30303
Tue Jun 21 00:56:29 2016 TCP     ***.***.***.148 42130 =>   ***.***.***.51 30303
Tue Jun 21 00:50:12 2016 TCP     ***.***.***.148 48768 =>   ***.***.***.159 30303
Tue Jun 21 00:52:43 2016 TCP     ***.***.***.148 53624 =>   ***.***.***.227 30303
Tue Jun 21 00:52:52 2016 TCP     ***.***.***.148 33946 =>     ***.***.***.7 30303
Tue Jun 21 00:52:53 2016 TCP     ***.***.***.148 33946 =>     ***.***.***.7 30303
Tue Jun 21 00:52:55 2016 TCP     ***.***.***.148 33946 =>     ***.***.***.7 30303
Tue Jun 21 00:53:24 2016 TCP     ***.***.***.148 48586 =>  ***.***.***.166 30303
Tue Jun 21 00:53:25 2016 TCP     ***.***.***.148 48586 =>  ***.***.***.166 30303
Tue Jun 21 00:53:27 2016 TCP     ***.***.***.148 48586 =>  ***.***.***.166 30303
Tue Jun 21 00:54:32 2016 TCP     ***.***.***.148 52458 =>   ***.***.***.218 30303
Tue Jun 21 00:54:33 2016 TCP     ***.***.***.148 52458 =>   ***.***.***.218 30303
Tue Jun 21 00:53:15 2016 TCP     ***.***.***.148 37778 =>    ***.***.***.89 30303
Tue Jun 21 00:53:16 2016 TCP     ***.***.***.148 37778 =>    ***.***.***.89 30303
Tue Jun 21 00:53:18 2016 TCP     ***.***.***.148 37778 =>    ***.***.***.89 30303
Tue Jun 21 00:51:11 2016 UDP     ***.***.***.148 30303 =>  ***.***.***.235 30303
Tue Jun 21 00:57:44 2016 TCP     ***.***.***.148 51854 =>   ***.***.***.173 30303
Tue Jun 21 00:57:45 2016 TCP     ***.***.***.148 51854 =>   ***.***.***.173 30303
Tue Jun 21 00:57:47 2016 TCP     ***.***.***.148 51854 =>   ***.***.***.173 30303
Tue Jun 21 00:51:06 2016 TCP     ***.***.***.148 59562 =>   ***.***.***.248 30303
Tue Jun 21 00:51:07 2016 TCP     ***.***.***.148 59562 =>   ***.***.***.248 30303
Tue Jun 21 00:51:09 2016 TCP     ***.***.***.148 59562 =>   ***.***.***.248 30303
Tue Jun 21 00:49:57 2016 TCP     ***.***.***.148 57668 =>   ***.***.***.44 30303
Tue Jun 21 00:49:57 2016 TCP     ***.***.***.148 57670 =>   ***.***.***.44 30303
Tue Jun 21 00:49:58 2016 TCP     ***.***.***.148 57668 =>   ***.***.***.44 30303
Tue Jun 21 00:49:58 2016 TCP     ***.***.***.148 57670 =>   ***.***.***.44 30303
Tue Jun 21 00:50:00 2016 TCP     ***.***.***.148 57670 =>   ***.***.***.44 30303
Tue Jun 21 00:50:00 2016 TCP     ***.***.***.148 57668 =>   ***.***.***.44 30303
Tue Jun 21 00:50:04 2016 TCP     ***.***.***.148 57670 =>   ***.***.***.44 30303
Tue Jun 21 00:50:04 2016 TCP     ***.***.***.148 57668 =>   ***.***.***.44 30303
Tue Jun 21 00:50:12 2016 TCP     ***.***.***.148 57670 =>   ***.***.***.44 30303
Tue Jun 21 00:50:28 2016 TCP     ***.***.***.148 57670 =>   ***.***.***.44 30303
Tue Jun 21 00:51:00 2016 TCP     ***.***.***.148 57670 =>   ***.***.***.44 30303
Tue Jun 21 00:55:48 2016 TCP     ***.***.***.148 49768 =>    ***.***.***.34 30303
Tue Jun 21 00:55:49 2016 TCP     ***.***.***.148 49768 =>    ***.***.***.34 30303
Tue Jun 21 00:49:19 2016 TCP     ***.***.***.148 35624 =>    ***.***.***.93 30303
Tue Jun 21 00:49:20 2016 TCP     ***.***.***.148 35624 =>    ***.***.***.93 30303
Tue Jun 21 00:49:22 2016 TCP     ***.***.***.148 35624 =>    ***.***.***.93 30303
Tue Jun 21 00:49:26 2016 TCP     ***.***.***.148 35624 =>    ***.***.***.93 30303
Tue Jun 21 00:49:34 2016 TCP     ***.***.***.148 35624 =>    ***.***.***.93 30303
Tue Jun 21 00:49:51 2016 TCP     ***.***.***.148 35624 =>    ***.***.***.93 30303
Tue Jun 21 00:50:23 2016 TCP     ***.***.***.148 35624 =>    ***.***.***.93 30303
Tue Jun 21 00:53:46 2016 TCP     ***.***.***.148 44774 =>  ***.***.***.174 30303
Tue Jun 21 00:53:47 2016 TCP     ***.***.***.148 44774 =>  ***.***.***.174 30303
Tue Jun 21 00:53:49 2016 TCP     ***.***.***.148 44774 =>  ***.***.***.174 30303
Tue Jun 21 00:53:53 2016 TCP     ***.***.***.148 44774 =>  ***.***.***.174 30303
Tue Jun 21 00:50:24 2016 TCP     ***.***.***.148 53872 =>   ***.***.***.63 30303
Tue Jun 21 00:52:52 2016 TCP     ***.***.***.148 58266 =>   ***.***.***.26 30303
Tue Jun 21 00:49:12 2016 TCP     ***.***.***.148 46302 =>  ***.***.***.244 30303
Tue Jun 21 00:49:12 2016 TCP     ***.***.***.148 46304 =>  ***.***.***.244 30303
Tue Jun 21 00:57:48 2016 TCP     ***.***.***.148 42648 =>   ***.***.***.20 30303
Tue Jun 21 00:57:49 2016 TCP     ***.***.***.148 42648 =>   ***.***.***.20 30303
Tue Jun 21 00:57:51 2016 TCP     ***.***.***.148 42648 =>   ***.***.***.20 30303
Tue Jun 21 00:48:57 2016 TCP     ***.***.***.148 42460 =>   ***.***.***.48 30303
Tue Jun 21 00:56:46 2016 TCP     ***.***.***.148 50656 =>   ***.***.***.89 30303
Tue Jun 21 00:52:01 2016 TCP     ***.***.***.148 42160 =>  ***.***.***.196 30303
Tue Jun 21 00:57:29 2016 TCP     ***.***.***.148 59892 => ***.***.***.182 30303
Tue Jun 21 00:57:30 2016 TCP     ***.***.***.148 59892 => ***.***.***.182 30303
Tue Jun 21 00:57:32 2016 TCP     ***.***.***.148 59892 => ***.***.***.182 30303
Tue Jun 21 00:56:07 2016 TCP     ***.***.***.148 51930 =>  ***.***.***.208 30303
Tue Jun 21 00:56:08 2016 TCP     ***.***.***.148 51930 =>  ***.***.***.208 30303
Tue Jun 21 00:56:10 2016 TCP     ***.***.***.148 51930 =>  ***.***.***.208 30303
Tue Jun 21 00:56:14 2016 TCP     ***.***.***.148 51930 =>  ***.***.***.208 30303
Tue Jun 21 00:57:51 2016 TCP     ***.***.***.148 55926 =>  ***.***.***.44 30303
Tue Jun 21 00:50:39 2016 TCP     ***.***.***.148 60888 =>  ***.***.***.93 30303
Tue Jun 21 00:50:40 2016 TCP     ***.***.***.148 60888 =>  ***.***.***.93 30303
Tue Jun 21 00:50:42 2016 TCP     ***.***.***.148 60888 =>  ***.***.***.93 30303
Tue Jun 21 00:50:46 2016 TCP     ***.***.***.148 60888 =>  ***.***.***.93 30303
Tue Jun 21 00:54:29 2016 TCP     ***.***.***.148 54026 =>  ***.***.***.43 30303
Tue Jun 21 00:54:07 2016 TCP     ***.***.***.148 59016 =>  ***.***.***.32 30303
Tue Jun 21 00:54:08 2016 TCP     ***.***.***.148 59016 =>  ***.***.***.32 30303
Tue Jun 21 00:54:10 2016 TCP     ***.***.***.148 59016 =>  ***.***.***.32 30303
Tue Jun 21 00:48:56 2016 TCP     ***.***.***.148 52032 =>  ***.***.***.117 30303
Tue Jun 21 00:53:04 2016 TCP     ***.***.***.148 50100 =>  ***.***.***.154 30303
Tue Jun 21 00:53:05 2016 TCP     ***.***.***.148 50100 =>  ***.***.***.154 30303
Tue Jun 21 00:53:07 2016 TCP     ***.***.***.148 50100 =>  ***.***.***.154 30303
Tue Jun 21 00:57:21 2016 TCP     ***.***.***.148 34924 =>   ***.***.***.52 30303
Tue Jun 21 00:52:01 2016 TCP     ***.***.***.148 41494 =>   ***.***.***.120 30303
Tue Jun 21 00:52:02 2016 TCP     ***.***.***.148 41494 =>   ***.***.***.120 30303
Tue Jun 21 00:52:04 2016 TCP     ***.***.***.148 41494 =>   ***.***.***.120 30303
Tue Jun 21 00:52:08 2016 TCP     ***.***.***.148 41494 =>   ***.***.***.120 30303
Tue Jun 21 00:48:57 2016 TCP     ***.***.***.148 40092 =>       ***.***.***.2 30303
Tue Jun 21 00:49:12 2016 TCP     ***.***.***.148 40512 =>       ***.***.***.2 30303
Tue Jun 21 00:49:12 2016 TCP     ***.***.***.148 40516 =>       ***.***.***.2 30303
Tue Jun 21 00:49:12 2016 TCP     ***.***.***.148 40514 =>       ***.***.***.2 30303
Tue Jun 21 00:49:12 2016 TCP     ***.***.***.148 40584 =>       ***.***.***.2 30303
Tue Jun 21 00:49:13 2016 TCP     ***.***.***.148 40584 =>       ***.***.***.2 30303
Tue Jun 21 00:49:15 2016 TCP     ***.***.***.148 40584 =>       ***.***.***.2 30303
Tue Jun 21 00:49:19 2016 TCP     ***.***.***.148 40584 =>       ***.***.***.2 30303
Tue Jun 21 00:49:27 2016 TCP     ***.***.***.148 40584 =>       ***.***.***.2 30303
Tue Jun 21 00:49:34 2016 TCP     ***.***.***.148 41262 =>       ***.***.***.2 30303
Tue Jun 21 00:49:35 2016 TCP     ***.***.***.148 41262 =>       ***.***.***.2 30303
Tue Jun 21 00:49:37 2016 TCP     ***.***.***.148 41262 =>       ***.***.***.2 30303
Tue Jun 21 00:49:44 2016 TCP     ***.***.***.148 40584 =>       ***.***.***.2 30303
Tue Jun 21 00:49:44 2016 TCP     ***.***.***.148 41902 =>       ***.***.***.2 30303
Tue Jun 21 00:49:45 2016 TCP     ***.***.***.148 41902 =>       ***.***.***.2 30303
Tue Jun 21 00:49:47 2016 TCP     ***.***.***.148 41902 =>       ***.***.***.2 30303
Tue Jun 21 00:49:51 2016 TCP     ***.***.***.148 41902 =>       ***.***.***.2 30303
Tue Jun 21 00:50:12 2016 TCP     ***.***.***.148 42656 =>       ***.***.***.2 30303
Tue Jun 21 00:50:16 2016 TCP     ***.***.***.148 40584 =>       ***.***.***.2 30303
Tue Jun 21 00:50:39 2016 TCP     ***.***.***.148 43210 =>       ***.***.***.2 30303
Tue Jun 21 00:50:40 2016 TCP     ***.***.***.148 43210 =>       ***.***.***.2 30303
Tue Jun 21 00:50:42 2016 TCP     ***.***.***.148 43210 =>       ***.***.***.2 30303
Tue Jun 21 00:50:46 2016 TCP     ***.***.***.148 43210 =>       ***.***.***.2 30303
Tue Jun 21 00:50:51 2016 TCP     ***.***.***.148 43462 =>       ***.***.***.2 30303
Tue Jun 21 00:50:51 2016 TCP     ***.***.***.148 43490 =>       ***.***.***.2 30303
Tue Jun 21 00:50:52 2016 TCP     ***.***.***.148 43490 =>       ***.***.***.2 30303
Tue Jun 21 00:50:54 2016 TCP     ***.***.***.148 43490 =>       ***.***.***.2 30303
Tue Jun 21 00:51:00 2016 TCP     ***.***.***.148 43818 =>       ***.***.***.2 30303
Tue Jun 21 00:51:01 2016 TCP     ***.***.***.148 43818 =>       ***.***.***.2 30303
Tue Jun 21 00:51:03 2016 TCP     ***.***.***.148 43818 =>       ***.***.***.2 30303
Tue Jun 21 00:52:43 2016 TCP     ***.***.***.148 46982 =>       ***.***.***.2 30303
Tue Jun 21 00:53:31 2016 TCP     ***.***.***.148 49148 =>       ***.***.***.2 30303
Tue Jun 21 00:53:32 2016 TCP     ***.***.***.148 49148 =>       ***.***.***.2 30303
Tue Jun 21 00:56:02 2016 TCP     ***.***.***.148 54736 =>       ***.***.***.2 30303
Tue Jun 21 00:56:03 2016 TCP     ***.***.***.148 54736 =>       ***.***.***.2 30303
Tue Jun 21 00:56:05 2016 TCP     ***.***.***.148 54736 =>       ***.***.***.2 30303
Tue Jun 21 00:56:09 2016 TCP     ***.***.***.148 54736 =>       ***.***.***.2 30303
Tue Jun 21 00:56:53 2016 TCP     ***.***.***.148 56344 =>       ***.***.***.2 30303
Tue Jun 21 00:56:54 2016 TCP     ***.***.***.148 56344 =>       ***.***.***.2 30303
Tue Jun 21 00:56:56 2016 TCP     ***.***.***.148 56344 =>       ***.***.***.2 30303
Tue Jun 21 00:57:00 2016 TCP     ***.***.***.148 56344 =>       ***.***.***.2 30303
Tue Jun 21 00:57:08 2016 TCP     ***.***.***.148 56344 =>       ***.***.***.2 30303
Tue Jun 21 00:57:44 2016 TCP     ***.***.***.148 58064 =>       ***.***.***.2 30303
Tue Jun 21 00:57:45 2016 TCP     ***.***.***.148 58064 =>       ***.***.***.2 30303
Tue Jun 21 00:57:47 2016 TCP     ***.***.***.148 58064 =>       ***.***.***.2 30303

I removed the IPs, but you can clearly see it is looking up the list of recent peers and tries to establish TCP connections to peers at port 30303 which is the default Ethereum network port.

Now, I had to shut down the node since the hoster said they will block me if I do not fix this within 12 hours. What could I do now?

Restarting Parity would probably get me block because their monitoring thinks I'm doing a wide-spread netscan. How to prevent being blacklisted for running an Ethereum client? Should I discuss this with the developers of parity upstream?


Update, I'm not alone with that issue and support told me this reason why I get flagged is the lookup of local area network IP addresses and suggested to block traffic to these address ranges as per RFC 1918.

  • 2
    The obvious: get in touch with the hoster and clear the mistake. Btw I don't have any problems yet with Hosteurope and Geth. – Roland Kofler Jun 21 '16 at 13:13
  • hey @5chdn how did it turn out in the end? Have you learned/ can you recommend something? – Roland Kofler Jul 20 '16 at 11:12
  • 1
    No, the hoster was pretty strict about that, I had to limit the node to the default 25 connections to avoid getting blocked again. – Waqar Lim Jul 20 '16 at 11:13
11

You can tell parity to avoid scanning private IPs by simply running:

parity --allow-ips public

You can even fine-tune parity to do less aggressive peering:

parity --allow-ips public --no-discovery --max-pending-peers 4 --min-peers 4 --max-peers 8

Or just block reserved IPs via iptables:

iptables -A OUTPUT -p tcp -s 0/0 -d 0.0.0.0/8 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 100.64.0.0/10 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 169.254.0.0/16 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 192.0.0.0/24 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 192.0.2.0/24 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 192.88.99.0/24 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 198.18.0.0/15 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 198.51.100.0/24 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 203.0.113.0/24 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 224.0.0.0/4 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 240.0.0.0/4 -j DROP

iptables -A OUTPUT -p udp -s 0/0 -d 0.0.0.0/8 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 100.64.0.0/10 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 169.254.0.0/16 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 192.0.0.0/24 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 192.0.2.0/24 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 192.88.99.0/24 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 198.18.0.0/15 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 198.51.100.0/24 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 203.0.113.0/24 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 224.0.0.0/4 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 240.0.0.0/4 -j DROP
7

I had a similar problem like you. Hetzner noticed that the abuse warning was triggered because the host tried to send tpc/udp packets to private network addresses (RFC1918). In order to avoid getting flagged, you can setup firewall rules blocking outgoing packets to RFC1918 networks.

Example using iptables:

iptables -A OUTPUT -p tcp -s 0/0 -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 192.168.0.0/16 -j DROP

iptables -A OUTPUT -p udp -s 0/0 -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 192.168.0.0/16 -j DROP
  • 1
    Thanks for sharing the iptables config. The RFC 1918 issue should be discussed with the devs at some point anyways. – Waqar Lim Nov 11 '16 at 9:03
2

Run parity with these flags (as suggested by Gavin Wood):

--auto-update=all --max-peers 10 --min-peers 5 --allow-ips public
2

I am currently using the following UFW rules in addition to --allow-ips public

ufw deny out on eth0 to 0.0.0.0/8 
ufw deny out on eth0 to 10.0.0.0/8 
ufw deny out on eth0 to 100.64.0.0/10 
ufw deny out on eth0 to 169.254.0.0/16 
ufw deny out on eth0 to 172.16.0.0/12 
ufw deny out on eth0 to 192.0.0.0/24 
ufw deny out on eth0 to 192.0.2.0/24 
ufw deny out on eth0 to 192.88.99.0/24 
ufw deny out on eth0 to 192.168.0.0/16 
ufw deny out on eth0 to 198.18.0.0/15 
ufw deny out on eth0 to 198.51.100.0/24 
ufw deny out on eth0 to 203.0.113.0/24 
ufw deny out on eth0 to 224.0.0.0/4 
ufw deny out on eth0 to 240.0.0.0/4 
0

There is currently no technical solution. The social solutions are twofold:

  1. Contact your hosting provider and negotiate
  2. Change your hosting provider
  • 2
    This is not entirely true as these answers show multiple technical solutions. I suggest to delete this answer. – Mikko Ohtamaa Sep 8 '17 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.