Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

knownagents.com

Post reply on HN
Print view View original

11–20 of 230 posts

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#11

Post by bflesch »

Bender wrote: post #2

Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies) . On that note, do not trust the linked source code but rather decompile the live code your phone is running and have AI ana…

Same for the origin IP address. The fiber leaving your country is tapped, and those people can inject packets with any origin IP that they want. Your ISP has no way to check if their peer actually received a certain packet from a certain country or not.

From a technical perspective, all this "china/russia" attribution is built on a quite shaky foundation. As a sysadmin you'd never know if it would be the British crown attacking your European company instead.

Not minimizing nation state cyber crime here, but the packet goes through many hands with different incentives.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#12

Post by codegeek »

Bender wrote: post #2

Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies) . On that note, do not trust the linked source code but rather decompile the live code your phone is running and have AI ana…

Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#13

Post by basilikum »

codegeek wrote: post #12
Bender wrote: post #2

Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies) . On that note, do not trust the linked source code but rather decompile the live code your phone is running and have AI ana…

Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.

> /commercial IP from legitimate users

No, because legitimate users do not just use residential and "commercial" IPs. Like me, right now

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#14

Post by VladVladikoff »

codegeek wrote: post #12
Bender wrote: post #2

Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies) . On that note, do not trust the linked source code but rather decompile the live code your phone is running and have AI ana…

Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.

Yes but it’s not cheap. Maxmind and ipinfo etc sell a tier that tells you this information, then you can 403 based on it. But the price is nuts like $40,000 a year.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#15

Post by djkurlander »

codegeek wrote: post #12
Bender wrote: post #2

Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies) . On that note, do not trust the linked source code but rather decompile the live code your phone is running and have AI ana…

Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.

I run an open source honeypot that collects these botnet scans and produces blocklists.

Blocklist download and configuration: https://knock-knock.net/blocklist

Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net

API: http://knock-knock.net/api

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#16

Post by VladVladikoff »

basilikum wrote: post #13
codegeek wrote: post #12

Earlier quoted context omitted.

Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.

> /commercial IP from legitimate users No, because legitimate users do not just use residential and "commercial" IPs. Like me, right now

You are the 0.001%

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#17

Post by KomoD »

gavinhking wrote: post #7
pjc50 wrote: post #5

Someone is always running mass vulnerability scans. That's a "water is wet" state of the Internet.

Definitely, the point here though is there is a stat sig surge in the chart in the last week, across thousands of websites. At least a surge in this particular spoofing pattern.

It's still not really anything special. Thousands isn't even large scale.

Any random bozo can trigger that.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#18

Post by basilikum »

VladVladikoff wrote: post #16
basilikum wrote: post #13

Earlier quoted context omitted.

> /commercial IP from legitimate users No, because legitimate users do not just use residential and "commercial" IPs. Like me, right now

You are the 0.001%

Much more than 0.001% of people care about their privacy or (the larger portion) do not have unfiltered access to the internet.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#19

Post by miah_ »

binaryturtle wrote: post #9

On average about 100 (TCP) requests hit my home router per minute doing various probing and scanning. Lots of checking for the telnet port obviously. Sometimes you can see a swarm of entirely different IPs scanning the full port range (probing the ports one-by-one). You'll see a lot of deepfield, censys-scanner, visionheight.com, shadowserver.io, etc., but also the usual suspects of Chinese or Russian IPs. With OpenW…

The easiest way to deal with the usual suspects is to just block the entire countries network range(s). There really is no reason they should be connecting to your home router anyway, and you lose nothing from blocking them.

Sure their packets will still hit your router, but if they are dropped immediately at least you're not wasting a syn-ack on them.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#20

Post by thedougd »

gavinhking wrote: post #8
yabones wrote: post #6

Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.

Another interesting thing here is the paths they're targeting, many are for newish AI coding tools

People or their agents must be accidentally committing or publishing their repository level secrets and configs with enough regularity that it’s worth scanning.
Post reply on HN