Regional IP and TLD blocking

[Duke5A]

Just had a student goof on the address to our online learning portal and wound up visiting a squatter site. Said squatter site forwarded to another site with a .PW TLD which spawned one of those fake virus popups prompting you to call an 800 number. The country TLD is for the Republic of Palau; which is located in the south Pacific. The actual server IP is Russian. This seems to be a daily occurrence that happens to both students and staff. Some staff are gullible enough to fall for some of this stuff. The last round of spear fishing email that made it past our spam filter was from an IP located in Africa.

 

I'm giving some real thought to blocking entire IP blocks for Russia, China and Africa in addition to numerous country TLDs. It would seriously cut down on risk. Anyone else take such drastic measures?

[Primus]

I'd say you need to be careful now, since IPv4 address exhaustion became a thing, some IP blocks have been re-used and you can't trust the IPs are actually assigned to those regions anymore.

[broomop]

you could maybe download a database that contains ips that are malicious instead.

[limawhiskey]

A lot of web filters will have rule sets for foreign TLDs.

 

We use Lightspeed and have then blocked for staff and students. I have also seen similar on Symantec's web filter.

 

Can cause minor problems with some of the trendy domain choices, but other than that I would say it's a safe bet to block them.

[Opendium_Steve]

Geoblocking IPs is fraught with problems because people host their servers wherever is cheapest, which is frequently not their own country.

[localzuk]

We have certain countries blocked by IP: China, Vietnam, North Korea, Russian Federation and Nigeria. This is based on the sheer volume of automated attack attempts that come from those countries.

 

Not had any complaints yet.

[ADMaster]

My ITC / LEA geo blocks, on occasion I've had to request them allow and IP through. I also add TLDs in my DNS server for places like .CN and .RU so that traffic doesn't even make it to the web filter or ITC firewall.

[Duke5A]

Thanks guys. I'm going to start with this: http://data.iana.org/TLD/tlds-alpha-by-domain.txt

 

I'll just pull out the most commonly used TLDs. I had no idea there were so many now. 95% of them are garbage. I'm going to block TLDs on the proxy servers and do the IP ranges at the firewall.

Edited December 9, 2016 by Duke5A