Blog | G5 Cyber Security

Stop DNS/Email Brute Force Attacks from Your IP

G5 Cyber Security

TL;DR

Someone is using your static IP address to attack other servers (likely DNS or email). This guide helps you identify the source of the problem, block malicious traffic, and protect your reputation. It’s likely malware on your network or a compromised device.

Steps to Resolve

  1. Confirm the Attacks
    • Check your server logs (DNS server logs, email server logs, firewall logs). Look for repeated failed login attempts or unusual DNS queries originating from your static IP.
    • Ask affected parties (if known) to provide evidence of attacks coming from your IP. They should be able to show you log entries with timestamps and query details.
  2. Scan Your Network for Malware
    • Run a full system scan with updated antivirus software on all devices connected to your network (computers, phones, IoT devices).
    • Consider using a dedicated malware scanner like Malwarebytes or Sophos Home.
    • Pay attention to any quarantine reports and investigate suspicious files.
  3. Check Router Security
    • Change your router’s password immediately! Use a strong, unique password.
    • Update your router’s firmware. Outdated firmware often has security vulnerabilities. Check the manufacturer’s website for updates.
    • Review connected devices. Log into your router’s admin interface and look at the list of connected devices. Identify any unknown or suspicious entries.
    • Disable remote administration (if not needed). Remote access can be a security risk.
  4. Firewall Configuration
    • Block outbound connections to known malicious IPs/domains. Use threat intelligence feeds or online databases of bad actors. Many firewalls allow you to import these lists automatically.
    • Implement rate limiting. Limit the number of DNS queries or email sending attempts from a single IP address within a specific timeframe. This can help mitigate brute-force attacks. 
      # Example using iptables (Linux) - limit outbound DNS to 10 queries per minute
iptables -A OUTPUT -p udp --dport 53 -m recent --name DNS --set
iptables -A OUTPUT -p udp --dport 53 -m recent --name DNS --update seconds 60 --hitcount 10 -j DROP
    • Consider GeoIP blocking. If you only need to communicate with servers in specific countries, block traffic from all other locations. 
      # Example using iptables (Linux) - block all outbound traffic from country code 'RU'
ftl -m geoip --src-cc RU -j DROP
  5. Investigate Compromised Devices
    • If you suspect a specific device is compromised, disconnect it from the network immediately.
    • Perform a forensic analysis of the device to identify the root cause of the compromise (e.g., what malware was installed, how it gained access). This may require specialized tools and expertise.
    • Reinstall the operating system on the compromised device as the most secure option.
  6. Contact Your ISP
    • Inform your Internet Service Provider (ISP) about the attacks. They may be able to provide assistance or investigate further.
    • Ask them if they have any security services available, such as DNS filtering or DDoS protection.
  7. Blacklist Removal Requests
    • If your IP address has been blacklisted by spam databases (e.g., Spamhaus, Barracuda), submit a delisting request to each blacklist provider after you have cleaned up the infection and implemented security measures. 
      # Example: Check if your IP is listed on Spamhaus
dig +short zen.spamhaus.org 8.8.8.8
Exit mobile version