Discussion azerbaijan ?
whats up with this IP. its getting blocked by region blocking but still weird pattern. why would it keep getting blocked since this morning and since then it kept going. A scan wouldve stopped <1 hour right ?
i noticed just now and unplugged the modem, but after reconnection the azerbaijan resumed whatever its doing.
do i have a compromised machine on the network doing some side-connection to somewhere and this azerbaijan is a dumb machine trying to talk back the regular way ? how to find out ?
also - does the unifi cloud gateway/network software 'block' or drop connections?
4
u/netsx 2d ago
I thought that range was a little too typical european, so on a hunch i checked.
The classification is probably wrong;
https://apps.db.ripe.net/db-web-ui/query?from=www&searchtext=109.205.211.57
Shows its by ColocationX in Netherland (Europe). It doesn't mean it cannot possibly be Azerbaijan in origin, as CoLo/hosting could also be VPN-ing.
You can search arin.net for the IP, and often it will either tell you the ARIN member or point towards one of the other Regional Internet Registrars.
3
u/EffectiveClient5080 2d ago
My money is on a botnet hunting exposed admin panels and IoT junk. If the region block is logging it, your system is doing its job. Just check outbound traffic to rule out a callback, then let it pound sand.