Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

knownagents.com

Post reply on HN
Print view View original

181–190 of 208 posts

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#181

Post by matheusmoreira »

TZubiri wrote: post #25
yabones wrote: post #6

Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.

Opening port 80 and realizing the world is an anarchic warzone is a canonic rite of initiation for otherwise innocent backend devs and sysadmins.

It's so bad the ISPs with CGNAT actually protect their users by acting as a sort of firewall...

So glad wireguard exists. It just drops all packets unless I authenticate with my cryptographic keys. It's like the computer is not even there.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#182

Post by cpburns2009 »

tommica wrote: post #132
cpburns2009 wrote: post #106

Earlier quoted context omitted.

Exactly this. It's no different from a bot pretending to be Googlebot. I've tried reporting abusive IPs to various foreign hosts, but nothing every comes to it. I've settled for just blacklisting excessively abusive IP ranges.

What is your way of detecting them? Just cat your way through your logs?

Almost lol: grep, sort and uniq. If I notice someone is hammering my employer's ecommerce site, I'll block them. It isn't required often so I've been reluctant to spend the time setting up fail2ban.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#184

Post by ryukoposting »

yabones wrote: post #6

Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.

If I had a nickel for every time my blog gets a reuqest probing some wordpress exploit, I'd have paid off my student loans years ago.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#185

Post by ryukoposting »

andai wrote: post #43
drewnick wrote: post #21

Earlier quoted context omitted.

Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.

I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!

I always had a decent bit of background noise, I think hosting on AWS comes with that. But after someone linked to me on hackaday the bot traffic went through the roof. One link to you from a noteworthy website, and all bets are off forever.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#187

Post by ycombinatrix »

nerdralph wrote: post #186

How can I attract more of these bots to my server? I want to test my Apache bad bot blocker. It uses basic header fingerprinting and h2 support to filter them. I get less than 5000 hits on an average day, and want a lot more.

run a redlib instance, bots hit these hard: https://github.com/redlib-org/redlib

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#188

Post by nik282000 »

gavinhking wrote: post #3
Bender wrote: post #2

Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies) . On that note, do not trust the linked source code but rather decompile the live code your phone is running and have AI ana…

Yeah, that's exactly what these visits are: faked user agents that fail IP verification or Web Bot Auth. What's interesting is the surge across so many websites in the last week.

I've had a similar bump in scanners in the past week, more than half of it is coming from MS and Google owned IPs and all of them are spoofing AI agents.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#189

Post by what »

tommica wrote: post #132
cpburns2009 wrote: post #106

Earlier quoted context omitted.

Exactly this. It's no different from a bot pretending to be Googlebot. I've tried reporting abusive IPs to various foreign hosts, but nothing every comes to it. I've settled for just blacklisting excessively abusive IP ranges.

What is your way of detecting them? Just cat your way through your logs?

Google (and other “legitimate” scrapers) publish the ip ranges they crawl from, anyone claiming to be googlebot (or whatever) but not in the ip range can safely be black holed.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#190

Post by martyvis »

mmh0000 wrote: post #112
hamdingers wrote: post #56

Earlier quoted context omitted.

Get a letsencrypt cert, I always get a massive wave of vulnerability probers after renewing.

It's all TLS certs, because they show up in the Transparency Log[1] You can watch a live stream of it here: https://bencevans.io/security/certificate-stream [1] https://en.wikipedia.org/wiki/Certificate_Transparency

TIL about Certificate Transparency (they didn't teach that in security school)
Post reply on HN