Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

knownagents.com

Post reply on HN
Print view View original

111–120 of 243 posts

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#111

Post by linkregister »

fultonn wrote: post #65
Colegno wrote: post #54

Earlier quoted context omitted.

I am always surprised that its considered legal. IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...

That sort of vulnerability scanning is at best legally dubious, and almost certainly illegal under CFAA and similar state statues when there's clear criminal intent. That's why the 2022 DOJ guidance regarding non-prosecution good faith security research was such a big deal at the time. > IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house... Fr…

[dead]

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#112

Post by mmh0000 »

hamdingers wrote: post #56
andai wrote: post #43

Earlier quoted context omitted.

I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!

Get a letsencrypt cert, I always get a massive wave of vulnerability probers after renewing.

It's all TLS certs, because they show up in the Transparency Log[1]

You can watch a live stream of it here: https://bencevans.io/security/certificate-stream

[1] https://en.wikipedia.org/wiki/Certificate_Transparency

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#113

Post by djkurlander »

Bender wrote: post #109
djkurlander wrote: post #15

Earlier quoted context omitted.

I run an open source honeypot that collects these botnet scans and produces blocklists. Blocklist download and configuration: https://knock-knock.net/blocklist Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net API: http://knock-knock.net/api

Cool site. I was curious and dropped your 100k list into a reverse DNS lookup site [1]. They may still have some of the records cached. I recognized quite a few of the scanner nodes and some other usual suspects. [1] - https://adver.tools/reverse-dns-lookup/

Yeah, that’s pretty interesting! You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net and choosing ISP from the carousel. That’s ordered by bot transaction count rather than IP count though.

It never ceases to amaze me that these ISPs don’t bother to shut down the botnets. They could do so very easily. For example, they could identify the IP address of every bot that hit this honeypot with their ASN with one API call: https://api.knock-knock.net/check-asn?asn=. (See https://knock-knock.net/api). They just don’t care!

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#114

Post by wilg »

Looks like Google has started rolling out this Web Bot Auth thing which seems like something that should gain adoption or become an open standard. https://developers.google.com/crawling/docs/crawlers-fetcher...

Seems like the crawler companies would be incentivized to not want to take responsibility for people spoofing their user agents.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#115

Post by doubled112 »

mmh0000 wrote: post #112
hamdingers wrote: post #56

Earlier quoted context omitted.

Get a letsencrypt cert, I always get a massive wave of vulnerability probers after renewing.

It's all TLS certs, because they show up in the Transparency Log[1] You can watch a live stream of it here: https://bencevans.io/security/certificate-stream [1] https://en.wikipedia.org/wiki/Certificate_Transparency

I use subdomains and a wildcard cert to partly obfuscate this.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#116

Post by gavinhking »

wilg wrote: post #114

Looks like Google has started rolling out this Web Bot Auth thing which seems like something that should gain adoption or become an open standard. https://developers.google.com/crawling/docs/crawlers-fetcher... Seems like the crawler companies would be incentivized to not want to take responsibility for people spoofing their user agents.

Yup, in fact most of them are already. That's one of the ways this data is verifying whether the visits are spoofed or not: https://knownagents.com/insights#spoofing-and-security

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#117

Post by Bender »

djkurlander wrote: post #113
Bender wrote: post #109

Earlier quoted context omitted.

Cool site. I was curious and dropped your 100k list into a reverse DNS lookup site [1]. They may still have some of the records cached. I recognized quite a few of the scanner nodes and some other usual suspects. [1] - https://adver.tools/reverse-dns-lookup/

Yeah, that’s pretty interesting! You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net and choosing ISP from the carousel. That’s ordered by bot transaction count rather than IP count though. It never ceases to amaze me that these ISPs don’t bother to shut down the botnets. They could do so very easily. For example, they could identify the IP address of every bot that hit this ho…

The ISP's do not have a financial incentive to shut them down. To them that's a paying customer. The feds will go after the big botnets if they are touching financial networks or siphoning enough money from people because there is usually a few big bank accounts and virtual currency exchange accounts they can seize once big enough to look good in the media. That's why it's on us and a few big CDN's to block some of them.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#118

Post by jwally »

djkurlander wrote: post #113
Bender wrote: post #109

Earlier quoted context omitted.

Cool site. I was curious and dropped your 100k list into a reverse DNS lookup site [1]. They may still have some of the records cached. I recognized quite a few of the scanner nodes and some other usual suspects. [1] - https://adver.tools/reverse-dns-lookup/

Yeah, that’s pretty interesting! You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net and choosing ISP from the carousel. That’s ordered by bot transaction count rather than IP count though. It never ceases to amaze me that these ISPs don’t bother to shut down the botnets. They could do so very easily. For example, they could identify the IP address of every bot that hit this ho…

What if I have a slimy TV box or nasty on my phone, living on my network?

You take IP down, you kill the cancer but you also end up killing the patient.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#120

Post by nubinetwork »

Bender wrote: post #100
nubinetwork wrote: post #89

Earlier quoted context omitted.

Per your link... > block http 1.1, real users only use 2.0 Chrome on android and Firefox on linux both appear to use 1.1 still...

By default they use 2.0 [1] unless someone or an addon disables it or unless the person is on a really old version. OperaMini however will use 1.1. No idea if anyone here uses OperaMini. There are some reader apps that act as a proxy that only support http/1.1. Be careful, some of those are not just readers and do not trust what they claim to be the source code. Some of them are created by cute and fuzzy bunnies. The…

Apparently nginx didn't enable it on my new server... why it's not enabled by default, I don't know... I retract my idiocy :P
Post reply on HN