Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visualizing malicious IP addresses

romeov.github.io

Post reply on HN
Print view View original

21–30 of 124 posts

Re: Visualizing malicious IP addresses

#21

Post by walterbell »

kimixa wrote: post #20
abound wrote: post #18

Earlier quoted context omitted.

Or alternatively, block port 22 entirely on your firewall and use something like Tailscale to access the machine. Of course, now your attack surface includes Tailscale, which has had it's own vulns in the past, but I think blocking all public traffic ends up being much stronger than any weaknesses Tailscale may introduce.

Isn't that just the same thing in different clothes? Just a different protocol offering the same features of authentication and encryption - often using exactly the same primitives? Is it "Security through obscurity" assuming fewer people are attacking vpn protocols that than ssh? And I'm not sure that's even true

Plus a centralized identity provider, which is a plus or minus depending on your threat model, https://tailscale.com/kb/1013/sso-providers

Re: Visualizing malicious IP addresses

#22

Post by mianos »

userbinator wrote: post #16
mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

Those probably belong to a CGNAT with many machines behind it.

Yes, I assumed it is an exit point of the great firewall or something like that, but they do so much packet inspection, they could easily block them. It's not like it's hard to see them.

Re: Visualizing malicious IP addresses

#23

Post by noah_buddy »

mcoliver wrote: post #8

Fun. You could also try putting the data into Google's data studio (now looker) to visualize them in an interactive map you can publish. Add things like size of dot corresponding to number of attempts, add reverse DNS/whois info to the info bubble, etc. Wonder how much came from residential vs business ip space. https://lookerstudio.google.com

If he published that, people will try and make the new leaderboard.

Re: Visualizing malicious IP addresses

#24

Post by lithiumii »

mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

If it's an ISP, maybe it's their crappy modems now part of a botnet.

Re: Visualizing malicious IP addresses

#26

Post by kube-system »

mianos wrote: post #22
userbinator wrote: post #16

Earlier quoted context omitted.

Those probably belong to a CGNAT with many machines behind it.

Yes, I assumed it is an exit point of the great firewall or something like that, but they do so much packet inspection, they could easily block them. It's not like it's hard to see them.

The Great Firewall is about blocking Chinese citizens from accessing content the party doesn’t find palatable. Being a good neighbor to the rest of the world is out of scope for that project.

Re: Visualizing malicious IP addresses

#28

Post by ies7 »

> Interesting! We can see the most locations in India, Indonesia, and China as well as a significant number in the US and Europe.

Are these because the bad guys are in there or just because of the population size?

China, India, US, and Indonesia are the top four of the most populous country and also 4 countries with most internet users.

Even the size of 10% of Indonesian internet users are almost the entire Taiwan population.

Re: Visualizing malicious IP addresses

#29

Post by dfex »

> Upon closer inspection of Asia, we can notice a significant number of addresses located in South Kora, (and possibly North Korea?), as well as in Taiwan.

> I was surpised to see that the distribution of attacks is extremely uneven with most of it concentrated in parts of Asia, Europe, and the US, and (almost) none from South America, Middle East, and Russia.

Aside from the casual stereotyping of bad actors here, the article completely neglects the fact that just because the attack is sourced from a certain IP/geolocation doesn't mean that the attacker resides in that location.

What you most likely have is a listed of pwned PCs with fast internet connections being used in botnets.

Post reply on HN