There's a guy trying to take down the server by sending as user/pass the lyrics of Rick Astley's "never gonna give you up"
From his home IP... very smart. https://ipinfo.io/86.120.252.156
Show HN: Watch bots interact with an SSH honeypot in real time
21–30 of 75 posts
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#22Re: Show HN: Watch bots interact with an SSH honeypot in real time
#23Re: Show HN: Watch bots interact with an SSH honeypot in real time
#24You know what extra data would be cool? If you hit `curl https://ip.guide/{src_ip} ` and got back the ASN and country etc and added a leaderboard. In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.
In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.
I'm currently fighting this battle.
As of this morning:
80% of malicious traffic comes from Azure.
10% from Digital Ocean.
5% from AWS.
5% from GCP.Re: Show HN: Watch bots interact with an SSH honeypot in real time
#25Earlier quoted context omitted.
From his home IP... very smart. https://ipinfo.io/86.120.252.156
Probably a relay through a "free" app installed on someone's phone or "smart" TV.
Nah, Spur (a company tracking residential proxies) doesn't flag it at all.
He's most likely just not very smart.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#26You know what extra data would be cool? If you hit `curl https://ip.guide/{src_ip} ` and got back the ASN and country etc and added a leaderboard. In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.
In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure. I'm currently fighting this battle. As of this morning: 80% of malicious traffic comes from Azure. 10% from Digital Ocean. 5% from AWS. 5% from GCP.
Closer to 95% if you count Teams.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#27Earlier quoted context omitted.
Probably a relay through a "free" app installed on someone's phone or "smart" TV.
Nah, Spur (a company tracking residential proxies) doesn't flag it at all. He's most likely just not very smart.
>Nah, Spur (a company tracking residential proxies) doesn't flag it at all.
I looked into it and so far as I can tell it works off a blacklist system, rather than any sort of automatic analysis (eg. TCP or MTU fingerprinting). If you set up a "residential proxy" in the form of a home VPN, it won't be detected. It also means the detection is only as good as whatever their backlist source is. If it's a niche provider, it might not get picked up at all.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#28Earlier quoted context omitted.
Probably a relay through a "free" app installed on someone's phone or "smart" TV.
Nah, Spur (a company tracking residential proxies) doesn't flag it at all. He's most likely just not very smart.
They're not doing a very good job at it, tried a few disposable free residential proxies - not flagged. Tried my CGNAT home connection - flagged. My phone connection - also flagged.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#29Earlier quoted context omitted.
Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier. Bad actors might use the data you're publishing to fingerprint specific exploits to which the machines are vulnerable, multiplying the problem. If producing an IP blacklist is one of your aims, divorcing it from any specific traffic would be more responsibl…
> Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier. Hard for me to find much sympathy for negligent users who unintentionally allowed their home computers or phones to join a malicious botnet, or their ISPs who aren't stopping the activity. Even if it is my own grandma's PC. I agree about the content thoug…
I disagree personally. If these IPs are being used to attempt to gain unauthorized access, it's better to make the public aware, imo.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#30Earlier quoted context omitted.
From his home IP... very smart. https://ipinfo.io/86.120.252.156
Probably a relay through a "free" app installed on someone's phone or "smart" TV.
IP is clean, most likely will pass any filtering. https://proxybase.xyz/ip/86.120.252.156