Block Censys Port Scans?

[OlderThanDirt]

I've been busy tightening up my router security after seeing AWS getting compromised multiple times and getting a lot of hits from Russian IP addresses. After shutting down traffic from more than a dozen countries and subnets, I'm left with just hits from Censys port scans, which I believe are harmless, but do identify the few ports that I still have open.

Censys does provide the information for their scanning subnets to allow one to opt out. However, there may be a benefit to allowing their port scans for research. Any thoughts? I'm not an IT guy, but my Unifi routers provide a lot of flexibility to block external traffic and snooping.

[Robotron2k84]

I’d opt out. For others that don’t have a web page or form for opting out, I block all scan subnets.

You simply have no way to certify that they are doing good with the results.

I probably have two thirds of the internet blacklisted from my IDS. I don’t re-allow compromised networks back into the allowed pool, ever. My IDS can see if there is legit traffic and prompt me to whitelist the subnet, but otherwise once they are flagged as bad, they are blocked forever.

I maintain a whitelist for the domains and services that I wish to provide services for.

As for outbound client connections, I have a separate switch and router for that and they bridge at the CPE, for cloud resources for everyday websites that may use transient VMs or connection pools. That client router has no open ports inbound.

Needless to say, having more than one router on your connection necessitates multiple IP addresses from the ISP, or a dedicated subnet passed to the CPE.

[OlderThanDirt]

[Cowboy T]

I don't know who Censys is, but anyone who port scans me, they're blocked automatically. Always assume a "deny inbound" posture to protect your trusted network or your DMZ, and only allow into your DMZ that which needs to be allowed. Allow *nothing* except for return traffic into your trusted network...unless you really, *REALLY* know what you're doing and why.

[OlderThanDirt]

I don't know who Censys is, but anyone who port scans me, they're blocked automatically. Always assume a "deny inbound" posture to protect your trusted network or your DMZ, and only allow into your DMZ that which needs to be allowed. Allow *nothing* except for return traffic into your trusted network...unless you really, *REALLY* know what you're doing and why.

While they seem harmless, they are blocked...

I have my port scans and other attempted intrusions down to one every few days and will continue to block the stragglers. I have 15 countries blocked and numerous subnets. One of my favorites:

The Privacyfirst Project - located in Mahe, Seychelles, but may originate in Ulaanbaatar, Mongolia 194.147.140.0/24

This prefix is assigned to The PRIVACYFIRST Project, a non-commercial initiative with the aim of ensuring uncensored access to the internet anywhere in the world.

We operate infrastructure jointly used by various VPN service providers. We have a very strong focus on privacy and freedom. In case of abuse, we encourage all international law enforcement agencies to get in touch with our abuse contact. Due to the fact that we keep no logs of user activities and only share data when it is legally required under our jurisdiction, it is very unlikely for a demand of user information to be successful. Still, that should not deter you from reaching out.

Sounds legit.