Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.
Colegno 10 minutes ago [-]
I am always surprised that its considered legal.
IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...
sethops1 2 minutes ago [-]
Unauthorized access is not legal, it's just not enforced in the slightest.
drewnick 1 hours ago [-]
Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.
andai 23 minutes ago [-]
I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!
hamdingers 6 minutes ago [-]
Get a letsencrypt cert, I always get a massive wave of vulnerability probers after renewing.
0xdeadbeefbabe 16 minutes ago [-]
I don't even have a domain name and I'm getting lots of hits.
TZubiri 1 hours ago [-]
Opening port 80 and realizing the world is an anarchic warzone is a canonic rite of initiation for otherwise innocent backend devs and sysadmins.
gavinhking 2 hours ago [-]
Another interesting thing here is the paths they're targeting, many are for newish AI coding tools
thedougd 1 hours ago [-]
People or their agents must be accidentally committing or publishing their repository level secrets and configs with enough regularity that it’s worth scanning.
gavinhking 1 hours ago [-]
Totally. I'm sure this campaign was inspired by sloppy vibe coding
lw18511811620 14 minutes ago [-]
[flagged]
hluska 52 minutes ago [-]
There are a few novel ones but I’ve been seeing most of them in my logs for longer than generative AI has existed. This isn’t remotely new, the vector is just getting bigger.
binaryturtle 2 hours ago [-]
On average about 100 (TCP) requests hit my home router per minute doing various probing and scanning. Lots of checking for the telnet port obviously. Sometimes you can see a swarm of entirely different IPs scanning the full port range (probing the ports one-by-one).
You'll see a lot of deepfield, censys-scanner, visionheight.com, shadowserver.io, etc., but also the usual suspects of Chinese or Russian IPs.
With OpenWRT I use something like this: `tcpdump -i pppoe-wan 'inbound and tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'`, or alternatively `tcpdump -i pppoe-wan 'inbound and tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn and not port 44000'`, if we have some torrent client running (e.g. here at port 44000) which would mess up the result. I'm not sure it's the best way to handle this, but it's definitely enlightening what bounces off on the router.
miah_ 1 hours ago [-]
The easiest way to deal with the usual suspects is to just block the entire countries network range(s). There really is no reason they should be connecting to your home router anyway, and you lose nothing from blocking them.
Sure their packets will still hit your router, but if they are dropped immediately at least you're not wasting a syn-ack on them.
tommyage 17 minutes ago [-]
I, temporarly, banned some ip range.
I didn't find a source for pinpointing countries; though I am interested. Could you point me to some sources which, deterministically, resolve to some countries? To my knowledge you can not reliably identify countries by ip since this would be dependent on DNS servers. Though I am just a application programmer!
Thanks in advance.
thesuitonym 7 minutes ago [-]
Your router doesn't care about their DNS settings. IP addresses are very easy to tie back to countries. The reason they say it's not reliable is because it's trivial to spoof the country, but even so, a lot of attackers don't even bother. It's sort of like the Nigerian prince scam calls: if you're wise enough to block Russia, you're not worth their time.
Your firewall vendor should supply you with country lists, just select the known bad ones and drop their traffic. If you have a consumer grade router, you will probably have to configure the blocklists manually.
Asmod4n 12 minutes ago [-]
Routers got such a thing build in nowadays, just gotta enable it (not the ones from your ISP of course)
heywire 12 minutes ago [-]
This is one reason I don’t mind that I’m behind CGNAT.
sroussey 33 minutes ago [-]
I have ubiquity UniFi for this reason (amongst others). OpenWRT is a good choice as well. Most home router software is such junk, might as well leave the door open..
impish9208 1 hours ago [-]
I can corroborate visionheight and shadowserver from my firewall logs.
Tharre 12 minutes ago [-]
Why would you voluntarily pretend to be a AI bot, when those have already a much higher chance of being blocked? Seems holly unproductive.
Best hypothesis I can come up with is to somehow make the AI companies look bad, but they seem to be doing an excellent job at that themselves already by scraping everyone hundreds of times per hour over and over.
Bender 3 hours ago [-]
Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies). On that note, do not trust the linked source code but rather decompile the live code your phone is running and have AI analyze it.
codegeek 2 hours ago [-]
Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.
djkurlander 1 hours ago [-]
I run an open source honeypot that collects these botnet scans and produces blocklists.
No, because legitimate users do not just use residential and "commercial" IPs. Like me, right now
VladVladikoff 1 hours ago [-]
You are the 0.001%
basilikum 1 hours ago [-]
Much more than 0.001% of people care about their privacy or (the larger portion) do not have unfiltered access to the internet.
VladVladikoff 1 hours ago [-]
Yes but it’s not cheap. Maxmind and ipinfo etc sell a tier that tells you this information, then you can 403 based on it.
But the price is nuts like $40,000 a year.
reincoder 52 seconds ago [-]
I work for IPinfo. We offer IPinfo Lite for free. With a little bit of time in identifying the ASNs, you can implement a decent way to block a good number of bots fairly easily using the free data alone.
KomoD 53 minutes ago [-]
You don't need to spend anywhere near $40k a year to get that info... You don't even need to spend $1
gavinhking 27 minutes ago [-]
What's your strategy?
sparkling 14 minutes ago [-]
Focsec.com IP database for offline use (datacenters, VPNs, proxies, bots) runs around $1k/month for internal-only use.
gavinhking 3 hours ago [-]
Yeah, that's exactly what these visits are: faked user agents that fail IP verification or Web Bot Auth. What's interesting is the surge across so many websites in the last week.
Bender 2 hours ago [-]
There are many possibilities but one of them could be some new vuln was released and they are looking for it. That would require looking at the URL's they are requesting. Botters run their own purpose built campaigns. Do you also have a summary of URL's requested by unique counts?
gavinhking 2 hours ago [-]
Looks like many of the paths relate to AI coding tools. There are some examples below the chart
hluska 50 minutes ago [-]
You keep repeating this about a small minority of the tools that were posted.
bflesch 2 hours ago [-]
Same for the origin IP address. The fiber leaving your country is tapped, and those people can inject packets with any origin IP that they want. Your ISP has no way to check if their peer actually received a certain packet from a certain country or not.
From a technical perspective, all this "china/russia" attribution is built on a quite shaky foundation. As a sysadmin you'd never know if it would be the British crown attacking your European company instead.
Not minimizing nation state cyber crime here, but the packet goes through many hands with different incentives.
pixl97 1 hours ago [-]
Problem here is there are not single fibers attaching (most) countries, but a bunch of them. If you control both the ingress and egress for some particular users it's possible, but if you don't then your probing packing may end up back in China with a lot of evidence of backscatter.
bflesch 31 minutes ago [-]
I'd be surprised if there is a single route from EU to non-EU countries which does not pass through British control.
Someone is always running mass vulnerability scans. That's a "water is wet" state of the Internet.
gavinhking 2 hours ago [-]
Definitely, the point here though is there is a stat sig surge in the chart in the last week, across thousands of websites. At least a surge in this particular spoofing pattern.
KomoD 1 hours ago [-]
It's still not really anything special. Thousands isn't even large scale.
Any random bozo can trigger that.
gavinhking 1 hours ago [-]
This is a random sample of completely unrelated websites, which indicates that the total scale is much larger. This is not saying that it is difficult to make thousands of requests.
hluska 46 minutes ago [-]
Is this your company? If it is, your cheerleading makes you very hard to trust. If it’s not, I’m sure that everyone gets the point - you adore everything about this research and can’t see any possible problems.
gavinhking 37 minutes ago [-]
Not asking for trust, just sharing the data/math
dewey 27 minutes ago [-]
You forgot the "Yes, that's my company" part in your reply (https://ghking.co)
gavinhking 18 minutes ago [-]
That doesn't change the data/math brother
dewey 15 minutes ago [-]
It's still good etiquette to disclose affiliation in online discussions.
gavinhking 13 minutes ago [-]
Fair enough
pixl97 1 hours ago [-]
I think this is more of a "if you left your AI tools exposed someone is looking for them" change. Hacking someone else's agents sounds like a great way to spend less on your own tokens.
Maxion 35 minutes ago [-]
Nah these are just the typical vuln scans that try all kinda basic shit, looking for anything commonly used AI tools included.
54 minutes ago [-]
j45 46 minutes ago [-]
This kind of stuff is getting pretty wild, even for using something like Cloudflare it seems like a good idea to have another layer behind it that's non-cloudflare for when vulnerabilities are discovered.
thesuitonym 3 minutes ago [-]
What, like some kind of firewall?
fenestella 1 hours ago [-]
[dead]
Rendered at 17:04:26 GMT+0000 (Coordinated Universal Time) with Vercel.
You'll see a lot of deepfield, censys-scanner, visionheight.com, shadowserver.io, etc., but also the usual suspects of Chinese or Russian IPs.
With OpenWRT I use something like this: `tcpdump -i pppoe-wan 'inbound and tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'`, or alternatively `tcpdump -i pppoe-wan 'inbound and tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn and not port 44000'`, if we have some torrent client running (e.g. here at port 44000) which would mess up the result. I'm not sure it's the best way to handle this, but it's definitely enlightening what bounces off on the router.
Sure their packets will still hit your router, but if they are dropped immediately at least you're not wasting a syn-ack on them.
Thanks in advance.
Your firewall vendor should supply you with country lists, just select the known bad ones and drop their traffic. If you have a consumer grade router, you will probably have to configure the blocklists manually.
Best hypothesis I can come up with is to somehow make the AI companies look bad, but they seem to be doing an excellent job at that themselves already by scraping everyone hundreds of times per hour over and over.
Blocklist download and configuration: https://knock-knock.net/blocklist
Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net
API: http://knock-knock.net/api
No, because legitimate users do not just use residential and "commercial" IPs. Like me, right now
From a technical perspective, all this "china/russia" attribution is built on a quite shaky foundation. As a sysadmin you'd never know if it would be the British crown attacking your European company instead.
Not minimizing nation state cyber crime here, but the packet goes through many hands with different incentives.
Any random bozo can trigger that.