121–130 of 243 posts
Earlier quoted context omitted.
I don't even have a domain name and I'm getting lots of hits.
I recently brought up a website on a never-before-seen .com domain. Within about 10 mins of bringing it up with a SSL certificate, Anthropic came knocking on the door requesting the front page. (Almost certainty due to them watching the Public Certificate Transparency logs)
Earlier quoted context omitted.
Yeah, that’s pretty interesting! You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net and choosing ISP from the carousel. That’s ordered by bot transaction count rather than IP count though. It never ceases to amaze me that these ISPs don’t bother to shut down the botnets. They could do so very easily. For example, they could identify the IP address of every bot that hit this ho…
What if I have a slimy TV box or nasty on my phone, living on my network? You take IP down, you kill the cancer but you also end up killing the patient.
I'd say its probably an acceptable casualty in the battleground that is the internet especially for little one-off sites hosting blogs, forums, chat servers, etc... For a bigger site I would expect that person may have to open a ticket with the platform such as Amazon accepting that some CDN's and firewalls may be harder to get the block removed. This is why we can't have nice things.
Earlier quoted context omitted.
Your router doesn't care about their DNS settings. IP addresses are very easy to tie back to countries. The reason they say it's not reliable is because it's trivial to spoof the country, but even so, a lot of attackers don't even bother. It's sort of like the Nigerian prince scam calls: if you're wise enough to block Russia, you're not worth their time. Your firewall vendor should supply you with country lists, just…
I wonder if adding the US is now sensible.
Earlier quoted context omitted.
By default they use 2.0 [1] unless someone or an addon disables it or unless the person is on a really old version. OperaMini however will use 1.1. No idea if anyone here uses OperaMini. There are some reader apps that act as a proxy that only support http/1.1. Be careful, some of those are not just readers and do not trust what they claim to be the source code. Some of them are created by cute and fuzzy bunnies. The…
Apparently nginx didn't enable it on my new server... why it's not enabled by default, I don't know... I retract my idiocy :P
Earlier quoted context omitted.
I recently brought up a website on a never-before-seen .com domain. Within about 10 mins of bringing it up with a SSL certificate, Anthropic came knocking on the door requesting the front page. (Almost certainty due to them watching the Public Certificate Transparency logs)
How do you know who's visiting? Reverse IP lookups? Or do they announce it in the headers?
Earlier quoted context omitted.
What if I have a slimy TV box or nasty on my phone, living on my network? You take IP down, you kill the cancer but you also end up killing the patient.
Not the person you are asking but site operators can not tell intent. It could be something nasty on the network or a botter feigning ignorance. I'd say its probably an acceptable casualty in the battleground that is the internet especially for little one-off sites hosting blogs, forums, chat servers, etc... For a bigger site I would expect that person may have to open a ticket with the platform such as Amazon accept…
IP Blacklists, no matter how good can't stop this. You have to start using stats or deep-diving telemetry.
Earlier quoted context omitted.
I don't even have a domain name and I'm getting lots of hits.
I recently brought up a website on a never-before-seen .com domain. Within about 10 mins of bringing it up with a SSL certificate, Anthropic came knocking on the door requesting the front page. (Almost certainty due to them watching the Public Certificate Transparency logs)
For the record I thought I had this site behind basic auth.
Earlier quoted context omitted.
Yeah, that’s pretty interesting! You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net and choosing ISP from the carousel. That’s ordered by bot transaction count rather than IP count though. It never ceases to amaze me that these ISPs don’t bother to shut down the botnets. They could do so very easily. For example, they could identify the IP address of every bot that hit this ho…
What if I have a slimy TV box or nasty on my phone, living on my network? You take IP down, you kill the cancer but you also end up killing the patient.
However, I can see the argument for giving the customer 24-48 hours to resolve the problem.
On average about 100 (TCP) requests hit my home router per minute doing various probing and scanning. Lots of checking for the telnet port obviously. Sometimes you can see a swarm of entirely different IPs scanning the full port range (probing the ports one-by-one). You'll see a lot of deepfield, censys-scanner, visionheight.com, shadowserver.io, etc., but also the usual suspects of Chinese or Russian IPs. With OpenW…