0

First off, I am no security expert!

Yesterday I registered a .cf domain, I needed it for about 10 minutes. About 5 minutes after domain registration I got over 100 scanner requests (I checked all requests, all are automated scanner requests like ZmEu etc.) in under 10 seconds.

  1. Considering the amount in such a short period and so soon after registration, am I being targeted or is this kinda everyday business for a .cf domain?
  2. All requests are exclusively over port 80. I had a few more ports (443,...) open. I am not sure how to interpret this?!
  3. All my things are written in c/c++ (sockets, openssl,...), is there a up to date list or something about common attacks targeting specifically c/c++ servers and how to prevent them?

--------------EDIT

I host the things on my own, on a few server. Further the services are always the same (same ports), same static ip, but only for a short period always linked to a different domain. And it was the first time I used a .cf domain. Now I am simply a bit afraid to repeat the process, because yeah if I am really beeing targeted I should check everything twice first.

  • Scanning is done against an IP address which might or might not be connected to one or even multiple domains. What makes you think that this scanning occurred because you've registered the domain? – Steffen Ullrich Jul 22 '18 at 9:02
  • "All my things are written in c/c++ (sockets, openssl,...),..." - there is no generic vulnerability in this area. Though applications written in these languages are more likely to be vulnerable against buffer overflows, double free etc. – Steffen Ullrich Jul 22 '18 at 9:13
  • Thank you both, for the comment and the answer I hope SyCode is reading this too. I guess my question was not clear enough, so I am hosting everything my own! Thats also the reason why i was thinking it is maybe connected to the domain registration, because i linked ofc my ip. – user182663 Jul 22 '18 at 9:15
  • @Steffen Ullrich I followed Openssl's doc, they also mentioned your two things. Is it kinda "enough" to consider only the vulnerabilities they mentioned? – user182663 Jul 22 '18 at 9:21
  • It is not enough. There are many different kind of vulnerabilities that can happen. Given that your application seems to be web based you should not only care about issues due to low level memory managment but also have a closer look at OWASP top 10 which care about issues specific to web applications. As for the scanning: this is part of the usual "noise" on the internet and you have to deal with it. – Steffen Ullrich Jul 22 '18 at 9:35
0

A few things, those scans might either be from your hosting company or third parties (e.g hackers). You might getter closer to the answer by clarifying if your hosting company offers some kind of automated security assessment. You probably agreed to such a service. Otherwise, your site is being probed for exploitable weaknesses by some hackers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy