Best practices for blocking anonymous IP traffic (Azure)

Conor 6

Hi all. Could anyone tell me if there is a best practice for blocking traffic from VPNs or Anonymous proxies using Azure WAF?

I see that there are a number of services (eg. IP2Location, MaxMind, Queue-it, IPHub) that provide lists of these IPs, but I'm not sure about the best way to use these to block traffic from Azure. It seems that AWS has a managed list that is easy enough to block but I cannot see any Azure equivalent.

Any advice would be much appreciated.

1 answer

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2022-06-13T17:35:24.3+00:00

Hello @Conor ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know if there is an Azure equivalent of Anonymous IP List for AWS Managed Rules.

The Azure WAF consumes Microsoft threat intelligence data feed to block malicious bot traffic as part of the Bot manager rule set. That data feed has information about TORs and anonymous proxies. You can enable a managed bot protection rule set for your WAF to block or log requests from known malicious IP addresses.
Refer : https://video2.skills-academy.com/en-us/azure/web-application-firewall/ag/bot-protection-overview
https://video2.skills-academy.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs?tabs=drs20#bot-rules

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Conor 6 Reputation points

2022-06-14T16:04:18.143+00:00

Thanks Gitarani, however we have WAF bot detection in place but it is letting through IPs that are marked as VPNs on these other lists so it is not solving our issues. We'd like to be able to block IPs marked on these 3rd party lists.

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2022-06-15T13:55:59.84+00:00

Hello @Conor ,

Thank you for the update.

Could you please share a couple of IP addresses that are not getting blocked by the WAF bot detection and I will discuss this with the backend team for more information?

Regards,
Gita Sharma

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2022-06-21T14:01:41.887+00:00

Hello @Conor ,

Could you please share the requested details for further investigation on this issue?

Regards,
Gita

Aubery Moore 0 Reputation points

2023-10-05T17:29:29.4833333+00:00

I am having the same issues as well. We have enabled the Microsof_BotManagerRuleSet_1.0 and enabled rules and have found multiple IP addresses associated with anonymizers that have not been blocked. Below are a few examples.

143.244.51.170

212.102.33.132

212.102.33.85

156.146.36.68

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-10-11T15:13:45.98+00:00

Hello @Aubery Moore ,

Apologies for the delay in response.

I searched for the above 4 IPs in Microsoft threat intelligence data feed but couldn't find any active data. May I know when did you get the above IPs in your logs?

Do you have the WAF logs where these IPs are logged? If yes, could you please share them?

Regards,

Gita

Aubery Moore 0 Reputation points

2023-10-18T15:10:48.22+00:00

Hello @GitaraniSharma-MSFT

These IPs were not logged in the Azure WAF logs. These were IPs that our internal team found during an Audit. Once we did a whois lookup, we found that these IPs were associated with an anonymizer service. We are looking for effective ways to block these kinds of IPs.

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-10-26T10:19:41.3533333+00:00

Hello @Aubery Moore , the central Microsoft threat intelligence team owns the malicious IP feed that Azure WAF consumes for the bot manager rule set. If you are seeing that some IPs are not getting blocked despite being malicious, then this needs to be reported to the threat intelligence team. So, if you have a support plan, I request you file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Best practices for blocking anonymous IP traffic (Azure)

1 answer

Your answer