4

Update September 2018: The events described below still happen to this day though less often from servers of The Shadow Server Foundation. By now I have denied access to most of their IP addresses, but I get a lot more connection attempts from other services like Leaseweb and whatnot. However, it still puzzles me as to why they want to connect. AFAIK via Bonjour mDNSResponder advertises network services (such as AFP file sharing) provided by my computer, as well as my self-chosen ".local" name.

In principle, I deny any connection to outside servers that are not Apple's.

Any further insights would be highly appreciated.

Recently I'm seeing access attempts by servers belonging to The Shadow Server Foundation to mDNSResponder (via Little Snitch actually). I got access attempts from 184.105.247.199, 184.105.247.227 and 184.105.247.207. While their mission might sound laudable,

Established in 2004, The Shadowserver Foundation gathers intelligence on the darker side of the internet. We are comprised of volunteer security professionals from around the world. Our mission is to understand and help put a stop to high stakes cybercrime in the information age.

I don't appreciate these attempts, so I block them (thanks, Little Snitch!).

My network configuration looks like this:

network config

In an attempt to block all of their IP ranges, I came across this web page on myip.ms, which lists these domain names under "Websites hosted by The Shadow Server Foundation". Among them a few dubious sounding domain names:

  1. malwr.com
  2. tvbsp.com
  3. foottraffix.com
  4. bilescotrej.com
  5. make-cash-at-home.com
  6. profit-case.com
  7. alfa-cash.com
  8. milerteddy.com
  9. sexy-ladies-wantmeet.com
  10. ladies-with-big-tits.com

Without having visited any of these, I'm wondering if anyone knows anything about these sites. Why is The Shadow Server Foundation trying to get access to my Mac?

Improve this question
11
  • @Tetsujin I also got requests from Apple (17.178.106.12), my ISP's DNS, OpenDNS and my local network (10.0.0.0/8), which I've all allowed. Should I be concerned?
    – Alex Ixeras
    Aug 29, 2017 at 10:22
  • As a fast hint, without enough technical information to analyse further, I would say that if Shadow Server Foundation ping your name (DNS) or IP, then this means that either your Mac or your router is hosting a crapware which first started to ping their honeypots. It could also be an uninvited neighbour computer squatting your Wi-Fi network.
    – dan
    Sep 3, 2017 at 9:44
  • Thanks for the edit to narrow this down one question - “why would anyone scan and open connections to a public IP?” should be easily answerable on security site. I’d support a follow on question here by you or @Tetsujin documenting how you determined that specific ip were accessing a specific process on your Mac (that process being mDNSresponder or another)
    – bmike
    Sep 3, 2017 at 15:21
  • @danielAzuelos What further technical information would you need to further analyse or support your theory?
    – Alex Ixeras
    Sep 4, 2017 at 4:47
  • 1
    That's like asking what Microsoft is doing on a computer.
    – Overmind
    Sep 5, 2017 at 12:08

1 Answer 1

Reset to default
2

Assumption

Those websites are (for the most of them) well known honeypots. They are designed to do lots of things, including luring bots into their networks.

I dont think the shadow server foundation scan random IP for information gathering. If you ended up in their list, there is some probability that your global IP have misbehaved, or did something suspicious.

Answer

Your global IP is not your mac, it's the WAN gateway of your router. With the info you gave, we just know that one or multiple device(s) inside your LAN might have somehow misbehaved. It can be anything with a private IP address obtained via your ISP's router:

If compromised device(s) there is, you have to find it. You don't want to be part of a botnet.

A second assumption could be that someone hijacked your wifi and did some nasty things. A third assumption could be that your ISP is misbehaving, if it's the case you can do nothing about it, so lets stick to those two possibilities:

  • One or multiple connected devices you own are misbehaving.

  • You got your WLAN breached.

I will try to guide you on how to perform some further investigations.

Going deeper

  • Breached WLAN ?

Goal: Find a connected device on your WLAN you do not own.

How to: From your router, monitor IP Leases / MAC address for at least one week. Check the past IP leases logs.

  • Compromised devices ?

Goal: Find unexpected behaviors from the connected devices you own.(C&C server connection, weird port/socket/protocol utilisation, shadow server foundation IP / Domain outgoing connections)

How to: Capture all your router outgoing packets for at least 24 hours, analyse and filter the .pcap with wireshark or your favorite packets analyzer tool.

Good luck.

Improve this answer
7
  • Thanks, @Baptiste. I have two private address spaces, one for the wired part and one for the wireless. // None of my phones or tablets is jailbroken, so I believe they're not misbehaving. I also don't run any bogus app on them. The wirelessly connected Mac only has the standard OS and a media player on it. The Media Player (Apple TV) is also not jailbroken. The NAS only contains a Backup and no apps are running from it. The (main) Mac is running a network traffic scanning utility (Little Snitch) and an anti malware software. Little Snitch detected attempts from The Shadow Server Foundation.
    – Alex Ixeras
    Sep 5, 2017 at 2:31
  • I have attached a network diagram. I don't allow visitor or guest access. While I have not hidden my SSID, I do have a strong password (WPA2).
    – Alex Ixeras
    Sep 5, 2017 at 2:35
  • 1
    @Alex just forget to ask you this: Your ISP use static or dynamic global ip address attribution ? Does your global ip changes after some amount of time ?
    – Baptiste
    Sep 5, 2017 at 2:40
  • I get a dynamic WAN IP. It does change when the router restarts. Sometimes the router restarts without my interaction. — Also, I have a utility that scans my local network to determine the identity of all machines and internet devices on the LAN. I can't see a device on there that I don't own, but I'll let it run for a while and save a report in intervals to see if there's any coming up.
    – Alex Ixeras
    Sep 5, 2017 at 3:35
  • Last question, I will edit the answer depending on your comment: Can you confirm you have been pinged/scanned by The Shadowserver Foundation with your router having different WAN IP. For instance if you reboot your router it should change your IP lease, will you still get scanned with a different WAN IP ?
    – Baptiste
    Sep 5, 2017 at 5:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .