Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visualizing malicious IP addresses

romeov.github.io

Post reply on HN
Print view View original

11–20 of 124 posts

Re: Visualizing malicious IP addresses

#13

Post by Gathering6678 »

mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

Or, it could mean there are a lot more devices in some places, and a lot of them may be vulnerable to becoming / are a part of botnets?

Re: Visualizing malicious IP addresses

#14

Post by asciii »

ametrau wrote: post #11

[flagged]

> How is it ok that if you use the internet, you, as a low trust society member, magically get access to a wealthier high trust society full of "suckers".

The internet is the greatest leveler. Don't hate the player, hate the game. If someone is a "low" trust society member and made a contribution to the entire network, we ALL benefit.

Also, isolating doesn't do shit because the big tech would like to monitor you solely for themselves (i.e. Tiktok).

Re: Visualizing malicious IP addresses

#15

Post by wiradikusuma »

Holy moly! That explains why I frequently get captcha when using residential internet in Jakarta. I don't see those captcha when accessing from e.g. Kuala Lumpur or Singapore.

Is the information in the article actionable? E.g. can I complain to someone with authority?

Re: Visualizing malicious IP addresses

#16

Post by userbinator »

mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

Those probably belong to a CGNAT with many machines behind it.

Re: Visualizing malicious IP addresses

#17

Post by unraveller »

If you're lucky enough to have a big ISP with a single big block of IP addresses that never changes you can disallow all other ranges on your VPS admin ports and only have to worry about VPNing through that ISP.

I guess you could block the main country offenders but you'd have to pay an API to keep up with the IP allocations to be sure.

Re: Visualizing malicious IP addresses

#18

Post by abound »

unraveller wrote: post #17

If you're lucky enough to have a big ISP with a single big block of IP addresses that never changes you can disallow all other ranges on your VPS admin ports and only have to worry about VPNing through that ISP. I guess you could block the main country offenders but you'd have to pay an API to keep up with the IP allocations to be sure.

Or alternatively, block port 22 entirely on your firewall and use something like Tailscale to access the machine.

Of course, now your attack surface includes Tailscale, which has had it's own vulns in the past, but I think blocking all public traffic ends up being much stronger than any weaknesses Tailscale may introduce.

Re: Visualizing malicious IP addresses

#20

Post by kimixa »

abound wrote: post #18
unraveller wrote: post #17

If you're lucky enough to have a big ISP with a single big block of IP addresses that never changes you can disallow all other ranges on your VPS admin ports and only have to worry about VPNing through that ISP. I guess you could block the main country offenders but you'd have to pay an API to keep up with the IP allocations to be sure.

Or alternatively, block port 22 entirely on your firewall and use something like Tailscale to access the machine. Of course, now your attack surface includes Tailscale, which has had it's own vulns in the past, but I think blocking all public traffic ends up being much stronger than any weaknesses Tailscale may introduce.

Isn't that just the same thing in different clothes? Just a different protocol offering the same features of authentication and encryption - often using exactly the same primitives?

Is it "Security through obscurity" assuming fewer people are attacking vpn protocols that than ssh? And I'm not sure that's even true

Post reply on HN