Login attempt on port 18190 from Russia

[ED]

Hi,

Logs & Monitor -> Audit Logs. 

The client IP's originate from Russia, LLC SvyazTelecom. They have tried from 4th Jan 2019 until today. Usually when you try to login with SmartConsole, it will say SmartConsole under Application field. Now the logs show unknown. The general information field error doesn't give me any information when searching usercenter. 

The IP's that tried are

185.156.177.19

185.156.177.23

185.156.177.24

185.156.177.28

This happened via implied rule which is default. Anyone from CheckPoint that can say more about the general information? 

[G_W_Albrecht]

I would involve TAC to have a look, but did you try sk114177: "Connection cannot be initiated. Please make sure that the server ... is up and running" e... yet ?

[ED]

We don't expect connections from Russia, escpecially not on port 18190   So this is some kind of attempt from a Russian automated attack or something.  

[Mark_Mitchell]

Hi Enis,

I assume that the login attempt was to your gateway? Has your gateway got a stealth drop rule for anything to your gateway? Or do you have your SMS published externally via a NAT rule?

It's slightly concerning that they got as far as entering credentials, the traffic should be prevented before getting to this point. 

Regards

Mark

[ED]

Hi Mark,

It's SMS with external IP and it was allowed because of the implied rule from global properties. 

[Kaspars_Zibarts]

Ask no more  RDP and all other protocols attempted from it

185.156.177.19 | VPSville LLC | AbuseIPDB 

[ED]

Thanks. Do you know if we can in R80.20/30 make a geo policy rule inside access policy where you can specify services allowed? 

[Kaspars_Zibarts]

We're still on R80.10  I would allow only specific IPs to access my mgmt from public space if you ask me. Basically explicit allow instead of explicit deny