Viewing profile — djkurlander

Crafted that awesome response to your original query myself, and I am very human.

Good question. You can certainly proxy SIP. But what’s notable here is that the traffic comes directly from organizations that should be secure: banks, infrastructure, governments.…

Much appreciated! Trying to help out the community with the honeypot & API, and it's always fascinating what attack patterns show up.

As mentioned above, wrote the blog post myself and had AI proofread and edit. As for the honeypot itself, I'm a greybeard computer scientist, and I architected the system very deli…

Wrote the blog post myself, and used AI to clear up typos and occasionally improve wording. I have a PhD in computer science, but I was initially planning to pursue journalism inst…

Ha! Love it. Totally believe in it too.

I set up servers on the net that masquerade as a SIP relay by essentially supporting the protocol but with few authentication protections. Malware bots scan the IPv4 space looking …

The actual blog post clarifies this as well. But still in some sense these organizations share some level of responsibility if it is their machines, attacking from their ASN.

Yes - I would have expected better from these institutions as well, but there's always going to be someone who brings their rogue laptop onto the corporate net. The key is how fast…

Thanks! Just trying to keep the world safe from marauding Teddy Bears.

[flagged]

OP here. See the hidden world of bot attacks and scanner chatter. Listen to Internet Background Radiation on a virtual Geiger counter. Here we are capturing Internet chatter across…

The goal is to educate people (originally my kids) about one particular aspect of cybersecurity. I love it when people use the site for this purpose. Yep, with ~80 knocks coming in…

OP here. Check out the new https://knock-knock.net . v1 got 40,000+ visits from HN alone, hoping you'll find v2 worth checking out too. Watch bots trying to break into my honeypots…

Thanks. I'd like to better understand the origin of DO's bot activity, and look forward to your report!

It has been 24 hours since this post went up, so here are some fun stats. During this time, there were 13,024 knocks on the server from 368 unique IPs. That's ~35 knocks per bot. D…

Ah, that makes sense. I’ve been wondering why DigitalOcean has so much of the bot traffic.

Hadn’t considered it, but that’s a nice idea. All of the necessary info, with time stamps, is already recorded in a SQL database, so it wouldn’t be difficult to replay events.

Thanks for pointing that out. T-Pot is cool and a more general honeypot framework. Potentially I could have built knock-knock.net on top of T-Pot.

Fail2ban would cut down on the noise quite a bit. I’ve installed it on other servers and have recommended it to others. But then we wouldn’t have all of this beautiful bot traffic …

Though strong passwords or preferably ssh keys are important, there will always be servers with weak passwords. And DO doesn’t have to side with individual abuse reporters. If they…

No, knock-knock.net is not hosted on DigitalOcean, and all 4 of my other knock-knock servers, using different providers, and distributed geographically currently have DigitalOcean …