Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visualizing malicious IP addresses

romeov.github.io

Post reply on HN
Print view View original

111–120 of 124 posts

Re: Visualizing malicious IP addresses

#111

Post by alephxyz »

iforgotpassword wrote: post #58
mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

It's not illegal to try to log in to an ssh server. Or many. Apart from that I think the map from the article is mostly matching the number of internet-connected devices per country/region. So I think you can replace "some" by "almost all" in your statement. I mean, find a vulnerable iot device, use it for scanning/botnet.

You may want to familiarize yourself with the Computer Fraud and Abuse Act

Re: Visualizing malicious IP addresses

#112

Post by tonymet »

darkwater wrote: post #55
tonymet wrote: post #53

why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.

Well, if you want to connect to your home LAN from your phone anywhere in the world you either need SSH or some VPN port opened either. Alternatively you can use some SaaS server where everything initiate the connection against the remote SaaS endpoint, but if you want to stay 100% local you need to open a port. For ssh changing the port to something else usually takes out 99% of bots.

Most VPS systems have an API to manage security group/ firewall.

When you arrive at the new location, call the API to open up the new address.

Here is the API on AWS https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_A...

Alternatively run a VPN or TailScale

Re: Visualizing malicious IP addresses

#114

Post by chgs »

iforgotpassword wrote: post #87
chgs wrote: post #67

Earlier quoted context omitted.

In what country? I suspect that given the intentions it would be a breach of the U.K. computer misuse act for example. Holding the perpetrator to the law is another matter of course.

> given the intentions Exactly. If I just nilly willy connect to your server, try a password and it works and I immediately disconnect, will that get me in trouble in the UK? That would be worrying.

Technically yes. You were trying to get unauthorised access to a server

But the law is never black and white. Programmers think the law is some code to run. It’s not.

Re: Visualizing malicious IP addresses

#116

Post by wizzwizz4 »

KomoD wrote: post #102
chx wrote: post #91

Earlier quoted context omitted.

1. mens rea probably applies 2. But if you make a stab at shoplifting and you are successful and give back the item, did you break the law? I am not a lawyer I am just asking.

> But if you make a stab at shoplifting and you are successful and give back the item, did you break the law? Well, yeah?

The Theft Act 1968 defines theft as dishonest appropriation of “property belonging to another with the intention of permanently depriving the other of it” (and then waxes lyrical about what, exactly, that means: https://www.legislation.gov.uk/ukpga/1968/60/crossheading/de...). Just going by that law, I would say "it depends".

Re: Visualizing malicious IP addresses

#118

Post by dang »

ametrau wrote: post #11

[flagged]

You can't post like this here, and I've banned the account.

Between this, https://news.ycombinator.com/item?id=40139695, and https://news.ycombinator.com/item?id=38834901, there's clearly a pattern of abusive behavior.

https://news.ycombinator.com/newsguidelines.html

Re: Visualizing malicious IP addresses

#119

Post by reincoder »

spacecadet wrote: post #117

I automate the hell out of packet capture, using the max ipinfo free tier each month... graph db... I cluster packets, organization dossier, and other collections of data as embeddings. Helps cut noise and identify anomalies faster.

I hope you are not being limited by our (IPinfo) free tier request limit in any way.

If you own a public website, you can take advantage of IPinfo's creditlink system and get up to 100K requests per month: https://ipinfo.io/contact/creditlink.

Also, our summary tool and map tool are free and do not require you to sign up. You can take advantage of them as well. They support up to 500k IP submissions.

Additionally, the free country ASN database provides unlimited requests, as it is just a database. Use the MMDB version of the database and the IPinfo CLI.

I understand you probably have a system in place, but please ping me if you need any assistance, especially with using our free IP database.

Re: Visualizing malicious IP addresses

#120

Post by wtfwhateven »

iforgotpassword wrote: post #58
mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

It's not illegal to try to log in to an ssh server. Or many. Apart from that I think the map from the article is mostly matching the number of internet-connected devices per country/region. So I think you can replace "some" by "almost all" in your statement. I mean, find a vulnerable iot device, use it for scanning/botnet.

it is absolutely illegal
Post reply on HN