Live data from Hacker News

Show HN: Watch bots interact with an SSH honeypot in real time

honeypotlive.cc

31–40 of 75 posts

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#31

Earlier quoted context omitted.

Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier. Bad actors might use the data you're publishing to fingerprint specific exploits to which the machines are vulnerable, multiplying the problem. If producing an IP blacklist is one of your aims, divorcing it from any specific traffic would be more responsibl…

> Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier. Hard for me to find much sympathy for negligent users who unintentionally allowed their home computers or phones to join a malicious botnet, or their ISPs who aren't stopping the activity. Even if it is my own grandma's PC. I agree about the content thoug…

when you read or are told not to click on that link in the e-mail, or open the attachment, you should fire up your monitor while you are clicking on the links.

it might be interesting to have an eye on this while you are talking to the phone scammer.

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#32
post #21

There's a guy trying to take down the server by sending as user/pass the lyrics of Rick Astley's "never gonna give you up"

From his home IP... very smart. https://ipinfo.io/86.120.252.156

Why is it not smart?

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#33
post #25

Earlier quoted context omitted.

Probably a relay through a "free" app installed on someone's phone or "smart" TV.

Nah, Spur (a company tracking residential proxies) doesn't flag it at all. He's most likely just not very smart.

Maybe he is doing it for fun and not actually trying to hack the website with Rick Astley lyrics?

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#36
post #11

You know what extra data would be cool? If you hit `curl https://ip.guide/{src_ip} ` and got back the ASN and country etc and added a leaderboard. In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.

In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure. I'm currently fighting this battle. As of this morning: 80% of malicious traffic comes from Azure. 10% from Digital Ocean. 5% from AWS. 5% from GCP.

Mine is very similar, but with DO and AWS swapped around.

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#39
post #21

There's a guy trying to take down the server by sending as user/pass the lyrics of Rick Astley's "never gonna give you up"

From his home IP... very smart. https://ipinfo.io/86.120.252.156

We don’t have static IPs at home in Romania. A restart of the router will just give that person another public IP and they won’t notice any repercussions.
Post reply on HN