8 ms·
I run playit.gg. Abuse is a big problem on our free tier. I’d get https://github.com/projectdiscovery/nuclei https://github.com/projectdiscovery/nuclei setup to
by patricklorio 10mo ago
I run playit.gg. Abuse is a big problem on our free tier. I’d get https://github.com/projectdiscovery/nuclei https://github.com/projectdiscovery/nuclei setup to scan your online endpoints and autoban detections of c2 servers.
- jborak 10mo agoThanks for sharing this. I run packetriot.com, another tunneling service and I ended up writing my own scanner for endpoints using keyword lists I gathered from various infosec resources. I had done some account filtering for origins coming out of Tor, VPN networks, data centers, etc. but I recently dropped those and added an portal page for free accounts, similar to what ngrok does. It was very effective at preventing abuse. I also added mechanism for reporting abuse on the safety page that's presented.
- patricklorio 10mo agoHave you found a way to detect xworm c2c servers?
- jborak 9mo agoOur services were used for C2 as well. I investigated it a bit but eventually decided to just drop TCP forwarding from our free-tier and that reduced our abuse/malware reports for C2 over TCP to zero essentially. One path I looked at was to use the VirusTotal API to help identify C2's that other security organizations were identifying and leverage that to automatically take down malicious TCP endpoints. I wrote some POCs but did not deploy them. It's something I plan on taking up again at some point next year.
- patricklorio 9mo agoWant to chat on discord? Maybe we could combine efforts to try and stop people abusing our services :). We have a few vendors sending us automated reports, maybe I could open it up for multiple projects. feel free to give me a ping on https://discord.gg/AXAbujx https://discord.gg/AXAbujx @patrick.