My IP was reported as abusive
-
Dear All,
My WAN IP was reported as abusive and I received notification from ISP to solve this issue.
See below AbuseIPDB report
Cand you please give some guidace to find to troubleshoot and find if any LAN device is infected with malware?Thank you!
Best regards -
Disconnect all LAN devices, visit them one by one and run available 'known to be good' anti-whatever scans on each of them.
As soon as you found the guilty device, don't stop, scan all your systems, as the one bad device can also infect other LAN devices.
And most important : have a talk with person who uses the infected PCs. Explain that he/she uses a shared resource, and that your rules apply if she/he wants to continue to use 'your' Internet connection. A lot can be done before you apply the bottom line rule "don't use a PC if you don't know what not to do".
If needed : place suspected devices on a separate LAN network, and go wild with limiting firewall rules on pfSense, although, the list you've shown mentions XML-RPC access, that a normal port 443 ( or 80 ) web server access : it's hard to block these ports as it will block every web server on the Internet.
-
@Gertjan maybe Suricata in IDS mode can help depending on what rules are triggered
-
G Gertjan referenced this topic on