Scans for Zyxel Backdoors Are Commencing

The IP's they list on that page are all listed in the netset/ipset files at firehol's ip blocklist [1] They are just open proxies. These files are explained on firehol's site. [2] Make sure your home routers admin interface is only listening on the LAN and not the WAN interface, as blocking scanners is an endless game of whack-a-mole. Another option to consider would be installing OpenWRT if your router model supports it. [3]

Example:

  grep -E "45.155.205.86" *.ipset
  bi_any_0_1d.ipset:45.155.205.86
  bi_badbots_0_1d.ipset:45.155.205.86
  bi_bruteforce_0_1d.ipset:45.155.205.86
  bi_ssh-ddos_0_1d.ipset:45.155.205.86
  bi_ssh_0_1d.ipset:45.155.205.86
  bi_sshd_0_1d.ipset:45.155.205.86
  blocklist_de.ipset:45.155.205.86
  blocklist_de_ssh.ipset:45.155.205.86
  blocklist_de_strongips.ipset:45.155.205.86
  bruteforceblocker.ipset:45.155.205.86
  et_compromised.ipset:45.155.205.86
  greensnow.ipset:45.155.205.86
  haley_ssh.ipset:45.155.205.86

[1] - https://github.com/firehol/blocklist-ipsets.git

[2] - http://iplists.firehol.org/

[3] - https://openwrt.org/toh/hwdata/zyxel/start