How to use Azure WAF block BLEXBot trying access sitemap.txt

Question

How to use Azure WAF block BLEXBot trying access sitemap.txt

Hoàng Lê Hiệp Minh 51

Hi everyone,
I have a task report alert from Azure and I have many alerts from BLEXBot with IP 162.55.85.215 trying to access sitemap.txt that are very noisy and I have been blocking IP on WAF but it's not working, they still access with the same IP, so anyone could give me advice for block BLEXBot

Thanks for your help!

KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2022-11-03T15:10:41.153+00:00

Hi @Hoàng Lê Hiệp Minh ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying to configure IP restriction in WAF.

I see you have used RemoteAddr as Match Type.
Can you please try using SocketAddr ?

Refer: Configure an IP restriction rule with a Web Application Firewall for Azure Front Door

Please let us know if this helps.

Cheers,
Kapil.

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Hoàng Lê Hiệp Minh 51 Reputation points

2022-11-04T07:45:01.817+00:00

I have been set SocketAddr but after 2 hours, I still have an alert from BLEXBot access sitemap.txt
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2022-11-04T16:26:18.207+00:00

Hi @Hoàng Lê Hiệp Minh ,

Ideally, this should not be the case.
I shall check this behavior and let you know.

Thanks,
Kapil
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2022-11-09T05:41:12.337+00:00

Hi @Hoàng Lê Hiệp Minh ,

To troubleshoot the exact issue, I believe we will need a specialized 1:1 session, where a support engineer can have a screen share session to pinpoint the issue.
If you have a support plan you may file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.

Thanks,
Kapil

Your answer

KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2022-11-03T15:10:41.153+00:00

Hi @Hoàng Lê Hiệp Minh ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying to configure IP restriction in WAF.

I see you have used RemoteAddr as Match Type.
Can you please try using SocketAddr ?

Refer: Configure an IP restriction rule with a Web Application Firewall for Azure Front Door

Please let us know if this helps.

Cheers,
Kapil.

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Hoàng Lê Hiệp Minh 51 Reputation points

2022-11-04T07:45:01.817+00:00

I have been set SocketAddr but after 2 hours, I still have an alert from BLEXBot access sitemap.txt
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2022-11-04T16:26:18.207+00:00

Hi @Hoàng Lê Hiệp Minh ,

Ideally, this should not be the case.
I shall check this behavior and let you know.

Thanks,
Kapil
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2022-11-09T05:41:12.337+00:00

Hi @Hoàng Lê Hiệp Minh ,

To troubleshoot the exact issue, I believe we will need a specialized 1:1 session, where a support engineer can have a screen share session to pinpoint the issue.
If you have a support plan you may file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.

Thanks,
Kapil

Share via

How to use Azure WAF block BLEXBot trying access sitemap.txt

Your answer