Amcrest IP3M-941W Cameras DDoSing Network

Have some questions or having issues with your IP Camera(s), Post them here for the mods and other users to assist you with.
Post Reply
shiftdelete
Posts: 2
Joined: Mon Jan 01, 2018 1:18 pm

Amcrest IP3M-941W Cameras DDoSing Network

Post by shiftdelete »

EDIT: Just noticed in my logs that the IP2M-841 is also hammering away. So it appears all Amcrest products are doing this.... Details appended below.

In the course of one week, I see all this traffic coming from my 4 Amcrest Camera's, all of which are IP3M-941W

Why the hell are these cameras hammering my network literally 12 times per second PER CAMERA!...

I do not subscribe to Amcrest cloud and have no interest in doing so...

Oddly enough, my IP2M-841 does not seem to have this issue.

All of these domains are getting blocked....

192.168.1.152, CAM03:
--------------------------------------------------------
121707 config.amcrestcloud.com
716 dh.amcrestsecurity.com
438 router.asus.com
1 media-amc-0.hostedcloudvideo.com
1 ftps.hostedcloudvideo.com
1 command-10.amcrestcloud.com

192.168.1.151, CAM02:
--------------------------------------------------------
121927 config.amcrestcloud.com
729 dh.amcrestsecurity.com
1 media-amc-0.hostedcloudvideo.com
1 ftps.hostedcloudvideo.com
1 command-2.amcrestcloud.com

192.168.1.150, CAM01:
--------------------------------------------------------
121862 config.amcrestcloud.com
729 dh.amcrestsecurity.com
3 media-amc-1.hostedcloudvideo.com
3 ftps.hostedcloudvideo.com
3 command-7.amcrestcloud.com

192.168.1.153, CAM04:
--------------------------------------------------------
120293 config.amcrestcloud.com
733 dh.amcrestsecurity.com
1 media-amc-0.hostedcloudvideo.com
1 ftps.hostedcloudvideo.com
1 command-2.amcrestcloud.com

EDIT: Found last camera in logs...So all cameras are apparently exhibiting this behavior

192.168.1.154, CAM05:
--------------------------------------------------------
102467 config.amcrestcloud.com
637 dh.amcrestsecurity.com
4 media-amc-1.hostedcloudvideo.com
4 ftps.hostedcloudvideo.com
4 command-1.amcrestcloud.com
Last edited by shiftdelete on Mon Jan 01, 2018 7:08 pm, edited 1 time in total.
Top
shiftdelete
Posts: 2
Joined: Mon Jan 01, 2018 1:18 pm

Re: Amcrest IP3M-941W Cameras DDoSing Network

Post by shiftdelete »

Actual log outpost post blocking.... The twitter-like stream of Amcrest hammering my network (by the cameras trying to phone home) continues..... This would explain why at times these camera's have been slow as molasses in the UI as all CPU cycles are being allocated to needless hammering of networks!

Jan 1 11:53:21 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:22 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:22 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:22 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:23 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:24 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:24 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:26 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:28 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:28 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:29 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:30 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:30 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:31 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:31 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:32 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:32 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:33 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:33 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:33 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:34 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:34 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:35 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:35 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:35 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:36 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:37 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:37 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:39 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:41 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:42 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:43 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:43 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:44 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:44 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:45 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:45 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:46 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:46 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:46 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:47 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:47 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:48 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:48 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:48 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:49 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:50 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Jan 1 11:53:50 dnsmasq[22584]: /tmp/mnt/AB/adblocking/blacklist.txt config.amcrestcloud.com is 0.0.0.0
Top
Post Reply

Return to “IP Cameras”