Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

knownagents.com

Post reply on HN
Print view View original

141–150 of 241 posts

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#141

Post by TZubiri »

iwontberude wrote: post #70
manapause wrote: post #62

Earlier quoted context omitted.

This is so true. Every junior sysadmin I have trained over the years (including myself) has had a “are we being attacked?!” moment when tasked with WAF report analysis, monitoring fail2ban logs, etc. Monitoring WAN traffic really gets the paranoia juices flowing.

I remember when you could stand up a website and no bots would scrape it or scan it. It was a lovely time. No one had firewalls or antivirus and things were working fine until the worms and viruses started coming. You could be confident that your guests were real, so much so we had guest counters on many public sites.

You still can.

Just build your website yourself as deep in the stack as you can instead of piling up 50 abstractions on top of each other. Some decisions like having your page be accessible by IP can only happen if you use technology like generic http servers (like apache or nginx) from the 2000s instead of implementing the lower stacks and actually thinking about whether that makes sense for a second.

If when you build a website or a backend, your server responds to requests by IP address (for example), you are building a bottom 90% product, and considering most software markets are super top-heavy, (say 1% win), that's ngmi land.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#142

Post by thenthenthen »

andai wrote: post #43
drewnick wrote: post #21

Earlier quoted context omitted.

Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.

I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!

I never had this issue really… until two years ago, new website new host… boom, hugged to death by thousands of bots per second. This is on an alicloud vps.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#143

Post by walrus01 »

Mass automated vulnerability scans have been a very common thing since years before the advent of this in 2001:

https://en.wikipedia.org/wiki/Code_Red_(computer_worm)

I remember when 'code red' spread and it had the effect of crapping up the contents of my apache server logs. Fun times.

such as:

GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#144

Post by somat »

yabones wrote: post #6

Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.

Yeah, It started bothering me enough that I recently put together a system where when a application detects a bad actor(a bot enumerating too fast, a random scan for vulnerabilities, etc) it notifies the firewall. Right now I am just shutting them down, But have plans for a honeypot/tarpit system, something real slow that takes up all their time. Something like "have fun at 300 baud"

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#145

Post by oasisbob »

Very similar experience here. Started July 30, sustained through August 6, when it started a significant ramp-up in volume (5x or so).

Most of the traffic is originating in GCP. We're seeing ~70k req/min sustained from Google Cloud IP space (AS396982). Reported to GCP Abuse, they've been non-responsive so far.

The main distinguishing factor is the reuse of a bunch of legit AI-training bot UserAgent strings. It's clear that the traffic is under the same centralized control because of how it changes volume across thousands of IP addresses simultaneously.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#147

Post by cullenking »

Gigachad wrote: post #134
esskay wrote: post #75

Earlier quoted context omitted.

Because businesses dont want them blocked, that would be a very stupid thing for most of them to do given its becoming a vital traffic source now that people are using chatbots instead of google.

From what I have seen at work, everyone is using chat bots but no one is visiting websites through them. We still get almost all traffic through social media and google search.

the numbers are much smaller than traditional search but they are trending up, and they convert at almost 2x the rate of organic search inbounds. sure you can play catchup later, but the trend is quite clear. if there's one thing the last two years have taught me, my prior heuristics on now vs future don't work in 2026.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#148

Post by ThePinion »

somat wrote: post #144
yabones wrote: post #6

Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.

Yeah, It started bothering me enough that I recently put together a system where when a application detects a bad actor(a bot enumerating too fast, a random scan for vulnerabilities, etc) it notifies the firewall. Right now I am just shutting them down, But have plans for a honeypot/tarpit system, something real slow that takes up all their time. Something like "have fun at 300 baud"

I'm doing the same thing. Set up a honeypot API and having it log everything anything tries to access outside that home page. Collected 15,000 hits in a week from 300 unique IPs doing the usual WordPress and .env scans.

I'm just collecting the data now to be used to secure some of my upcoming projects, but I would absolutely also like to take it in a direction where it sends the bots into an infinite slow loop, or preferably something that burns as many tokens as possible for them.

I don't really care about the morality of that. I'm a big fan of fighting fire with fire.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#149

Post by bigbuppo »

yabones wrote: post #6

Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.

[dead]

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#150

Post by bigbuppo »

hamdingers wrote: post #56
andai wrote: post #43

Earlier quoted context omitted.

I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!

Get a letsencrypt cert, I always get a massive wave of vulnerability probers after renewing.

Yeah... you have to remember to setup and fully secure the site before LE certs are issued or you're going to have a bad time. Learned that the hard way when I popped a couple dozen wordpress sites in one go.
Post reply on HN