netscan on port 7001 and 7770

[mahdiyari]

My server got marked for abuse because of detected netscan on port 7001
It is trying a bunch of IP addresses on port 7001

[mahdiyari]

Fri Feb 24 22:37:46 2023 TCP    49.12.242.34 4001  =>      198.18.0.6 7001
> Fri Feb 24 22:37:52 2023 TCP    49.12.242.34 4001  =>      198.18.0.6 7001
> Fri Feb 24 22:37:55 2023 TCP    49.12.242.34 4001  =>      198.18.0.6 7001
> Fri Feb 24 22:37:42 2023 TCP    49.12.242.34 4001  =>      198.18.0.7 7001
> Fri Feb 24 22:37:43 2023 TCP    49.12.242.34 4001  =>      198.18.0.7 7001
> Fri Feb 24 22:37:45 2023 TCP    49.12.242.34 4001  =>      198.18.0.7 7001
> Fri Feb 24 22:37:46 2023 TCP    49.12.242.34 4001  =>     198.18.0.11 7001
> Fri Feb 24 22:37:49 2023 TCP    49.12.242.34 4001  =>     198.18.0.18 7001
> Fri Feb 24 22:37:51 2023 TCP    49.12.242.34 4001  =>     198.18.0.18 7001
> Fri Feb 24 22:37:42 2023 TCP    49.12.242.34 4001  =>     198.18.0.19 7001
> Fri Feb 24 22:37:43 2023 TCP    49.12.242.34 4001  =>     198.18.0.23 7001
> Fri Feb 24 22:37:44 2023 TCP    49.12.242.34 4001  =>     198.18.0.23 7001
.
.
.
> Fri Feb 24 22:37:41 2023 TCP    49.12.242.34 4001  =>    198.18.1.218 7001
> Fri Feb 24 22:37:49 2023 TCP    49.12.242.34 4001  =>    198.18.1.236 7001
> Fri Feb 24 22:37:52 2023 TCP    49.12.242.34 4001  =>    198.18.1.247 7001
> Fri Feb 24 22:37:55 2023 TCP    49.12.242.34 4001  =>    198.18.1.247 7001
> Fri Feb 24 22:37:50 2023 TCP    49.12.242.34 4001  =>      198.18.2.5 7001
> Fri Feb 24 22:37:53 2023 TCP    49.12.242.34 4001  =>      198.18.2.5 7001

[mahdiyari]

I confirmed this is happening when the server is running honeycomb-spkcc using docker-composer and stops when I stop honeycomb-spkcc .

[disregardfiat]

4001 is a port used by ipfs. I'll look thru my logs to see if i have any similar issues.

[vaultec81]

Going to close in favor of these on going topics on the IPFS side: ipfs/kubo#5418 ipfs/kubo#6932

[mahdiyari]

Those issues are 3 years old and will never get fixed from the looks of it.

[vaultec81]

@disregardfiat Might be worth using the ipfs server profile in the docker container? I've been able to run ipfs on numerous providers with no issues (such as hetzner) for a good period of time now using that configuration.

[disregardfiat]

docker-compose updated