BaroqueInMind

That is a shady sketchy as fuck Russian site. Please, if anyone is reading this, DO NOT access it or put your fucking IP in there.

If your DNS sinkhole is down, your modem/router/host operating system settings (and even the PiHole itself) should allow a fallback. If you didn’t set that up and don’t know how, then you should consider not using Pihole until you know what you’re doing.

Maybe people should stop acting like peal clutching, limp-wrist, fragile little bitches when reading naughty words on the internet or when reading a critique about something/someone. Or maybe we should all talk polite and act kind to one another even when it’s not truly genuine or necessary. Both are possible.

I don’t see any quality shit coming from your unimaginative and useless account.

deleted by creator

This is he best Cloudflare guide I’ve seen so far. Thank you!

OMG I love that new amazing tracker that everyone is currently using, named…

runtipi.io

All apps send telemetry, this includes NewPipe. Your data is in that telemetry. The less apps you have installed, the less likely your data is sent to parties that leverage your information for profits.

DDG has a browser, and it’s based on Chromium which is from Google, so this is a shit take. Do not use Chromium based browsers if you value privacy or ad blocking features.

Why install the app when all the same features work in browser? Not only did I save storage space, I also kept privacy as well as reduced CPU/RAM usage on my mid-tier phone using the browser that was already installed.

That’s very low. I know a QA game tester who makes that much in California, and $70k is essentially almost poverty income in the Bay Area and LA county.

Is that the one where humans are consensually employed by all the comparatively more advanced alien species of our galaxy as their warriors or executives because even our weakest human is significantly more powerful to any of the nearest alien due to the nature of us all having been evolved from an ancient ape species that were prone to violence?

How does this compare to AdGuard Home?

Mines behind an NGINX reverse proxy as well. EMOTET is a very advanced malware and can get around those now. My IDS detected data exfiltration to an unknown Brazilian IP, and I have a VPN with an IP tunnel on top of my reverse proxy, as well as everything on port 443. It still found a way.

First read this

Then use the following:

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:“[CIS] Emotet C2 Traffic Using Form Data to Send Passwords”; content:“POST”; http_method; content:“Content-Type|3a 20|multipart/form-data|3b 20|boundary=”; http_header; fast_pattern; content:“Content-Disposition|3a 20|form-data|3b 20|name=|22|”; http_client_body; content:!“------WebKitFormBoundary”; http_client_body; content:!“Cookie|3a|”; pcre:“/:?(chrome|firefox|safari|opera|ie|edge) passwords/i”; reference:url,cofense.com/flash-bulletin-emotet-epoch-1-changes-c2-communication/; sid:1; rev:2;)

And the following:

alert tcp any any -> any $HTTP_PORTS (msg:“EMOTET:HTTP URI GET contains ‘/wp-content/###/’”; sid:00000000; rev:1; flow:established,to_server; content:“/wp-content/”; http_uri; content:“/”; http_uri; distance:0; within:4; content:“GET”; nocase; http_method; urilen:<17; classtype:http-uri; content:“Connection|3a 20|Keep-Alive|0d 0a|”; http_header; metadata:service http;)

And also this one:

alert tcp any any -> any $HTTP_PORTS (msg:“EMOTET:HTTP URI GET contains ‘/wp-admin/###/’”; sid:00000000; rev:1; flow:established,to_server; content:“/wp-admin/”; http_uri; content:“/”; http_uri; distance:0; within:4; content:“GET”; nocase; http_method; urilen:<15; content:“Connection|3a 20|Keep-Alive|0d 0a|”; http_header; classtype:http-uri; metadata:service http;)

I will simply copy/paste here then:

I have a refurbished server rack system that is running Zeek and also Suricata. I have a managed switch that will duplicate all network traffic to the system that is running those applications and a JBOD setup to store the countless logs. I have scoured through nearly all the CISA documents and alert reports to copy the various Snort rules they mention in each report and also purchased a specific modem to connect with my ISP that provides a service to monitor my traffic that has Minim.

I am a cybersecurity expert and still don’t know what I’m doing most of the time, so this is literally scratching the surface, as well as only detecting threats not really stopping them which requires more knowledge.

deleted by creator

I have a refurbished server rack system that is running Zeek and also Suricata. I have a managed switch that will duplicate all network traffic to the system that is running those applications and a JBOD setup to store the countless logs. I have scoured through nearly all the CISA documents and alert reports to copy the various Snort rules they mention in each report and also purchased a specific modem to connect with my ISP that provides a service to monitor my traffic that has Minim.

I am a cybersecurity expert and still don’t know what I’m doing most of the time, so this is literally scratching the surface, as well as only detecting threats not really stopping them which requires more knowledge.

I have nginx setup and acessing through a Cloudflare tunnel but still getting EMOTET issues detected by my IDS.