7
votes

Over the last few weeks I have seen dozens if not hundreds of break-in attempts from ip addresses which map back to secureserver.net. I know these are GoDaddy machines from the who is look up. Something seems to be going on with their network of machines. Every day I see a machine try to log in via ssh as root, admin, etc. I block those ip subnets and every day a new batch shows up in the log.

I can't find an abuse contact to report it. When I called them I just got a lot of crap from the guy on the other end of the phone who kept demanding my account number. I couldn't get through to him that I was not a customer but was concerned that their network had been compromised.

Has anyone else noticed an unusual number of break in attempts from GoDaddy servers? Does anyone know who I should report this to?

5
  • 4
    When you say 'ip addresses which map back to secureserver.net' - how are you determining that these IP addresses map back to secureserver.net? By way of a PTR record lookup for these IP addresses? Or, by way of a whois lookup for these IP addresses? Or, some other way? Can you post one of the IP addresses that you are seeing this activity from? – mti2935 May 18 '15 at 20:46
  • 1
    GoDaddy provides DNS and other web services. It is likely that on of their customers has been compromised or someone is using their services for these attacks. It does not mean that GoDaddy itself has been compromised. – schroeder♦ May 19 '15 at 3:40
  • Here are a few. I stopped keeping track of them after a few days. 50.63.128.206 ip-50-63-128-206.ip.secureserver.net 50.63.130.96 ip-50-63-130-96.ip.secureserver.net 50.63.136.240 ip-50-63-136-240.ip.secureserver.net 68.178.146.206 ip-68-178-146-206.ip.secureserver.net 72.167.32.16 ip-72-167-32-16.ip.secureserver.net 72.167.36.73 ip-72-167-36-73.ip.secureserver.net 72.167.93.1 ip-72-167-93-1.ip.secureserver.net 72.167.145.194 ip-72-167-9145.194.ip.secureserver.net 97.74.81.74 ip-50-63-130-96.ip.secureserver.net 97.74.125.55 ip-97-74-125-55.ip.secureserver.net – Matt Mashyna May 19 '15 at 13:22
  • I see one already this morning: May 19 07:34:18 www sshd[98252]: Failed password for root from 72.167.55.110 port 46659 ssh2 – Matt Mashyna May 19 '15 at 13:33
  • If you must have SSH enabled, then at least disable password login in the configuration for Internet-facing systems. For Internet-facing systems you should use key-pairs to authenticate. – jippie Nov 28 '15 at 14:29
5
votes

Very odd that the attacks came from secureserver.net Being a previous customer of GoDaddy in the past I have only seen that domain name used for mail services. Reference: https://login.secureserver.net/?app=wbe I would preform a whois on the offending ip and report the issue to tech support/abuse consultant. This information is located in the whois report. If no response then take your complaint to a black list service provider and you will get a response.

Before using any of the methods above I would use this form to submit a complaint.

https://supportcenter.godaddy.com/AbuseReport/Index?ci=

1
  • How embarrassing, I didn't see the abuse email in the whois last time. I'll try it. I did look at that web page before but none of the options apply and the phone support only seems to help their customers – Matt Mashyna May 19 '15 at 13:29
3
votes

I recommend Fail2ban to mitigate login attacks. It's a free/open source automated solution that requires no configuration for protecting against SSH login attempts.

If an IP tries and fails to log in too often (iirc, this defaults to 10 tries in 10 minutes), Fail2ban will tell the system's firewall to drop that IP's traffic for some time (iirc, defaulting to 10 minutes). Fail2ban also looks for particular exploit probes and can block those as well.

Once you have a mitigation in place, you can then work to help others by working to stop the problem at its source. Reach out to GoDaddy's abuse team and tell them about the issue. Hopefully, they can use your logs to track down the source of their problem.

See also the SSHPsychos incident, in which Cisco Talos was able to correlate a third of all worldwide SSH login sweeps to a single network, which Level 3 Communications then effectively took off the internet. (The attacks did resume from another network, but each takedown is significantly more expensive for the attackers than the defenders.)

1
  • OP said that they called and got no where without having an account with GoDaddy. – schroeder♦ Jan 27 '19 at 15:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.