Entry points are mapped
Probes can find security gateways and remote access services that answer from outside.
Industry blocklist
Government and Public Sector blocklist
Bring current scanner sources into perimeter review for reachable gateways and remote access services.
The coverage
What our sensors observed
Our sensors saw probes against security gateways and remote access services. The current mapping is tied to these exposed entry points and does not cover every public service.
Why use this feed
The current feed is focused on exposed security gateways and remote access, so start with those entry points rather than applying it to every public service. Add observed scanner sources to the firewall rules there and review blocks against staff, support, and partner access. Offices using the same gateway types can work from the same source list. User identity and device checks still decide who is allowed in.
The challenges
Scanning can reveal a reachable service before an exploit attempt, whether a flaw is known or still undisclosed. Our sensors record sources doing that probing. A firewall rule using the feed can deny a listed source before its next connection reaches your service, without needing to recognize the exploit itself.
A gateway flaw may follow
If an exposed appliance or remote service has a weakness, later traffic can attempt it at the same edge.
The first office contact
A source recorded against similar services can be filtered before it reaches another office gateway.
Edge enforcement
Defend your edge
The feed loads matching rules into your firewall. Listed sources are intercepted before crossing the edge; traffic with no match continues to your services.
Where this feed fits
Use the observed source list where your existing edge controls meet these reachable services.
Review scanner sources in the rules on exposed security gateways. Check that essential outside connections remain allowed.
Apply the list around a reachable desktop access service. Staff sign in and device checks still need separate controls.
Use the feed in front of exposed screen sharing access. Review any exceptions for support staff who need it.
Check the list against gateway rules for partners who connect from outside. Keep approved partner addresses in the access review.
Send the same updated source list to office gateways instead of collecting addresses office by office.
Use the feed when checking which scanner sources reached the types of gateway in this mapping. Apply blocks only where those gateways are actually exposed.
Industry blocklist
Start blocking observed scanner sources.
Choose this industry, connect the feed to your firewall, and review access with the people who run each service.