[flagged]
Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
201–210 of 214 posts
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#202How can I attract more of these bots to my server? I want to test my Apache bad bot blocker. It uses basic header fingerprinting and h2 support to filter them. I get less than 5000 hits on an average day, and want a lot more.
I went from 2k hits a day to 15k in the past week. Point a domain at your IP, use letsencrypt, post your domain on Reddit, github, x, etc. The bots will find you.
How letsencrypt "helps"?
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#203Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#204[flagged]
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#205Earlier quoted context omitted.
Using a normal page per blog entry would go a long way to making your site more indexable, readable, shareable and seo-able. (Good article btw).
That is a “normal page” for a single blog entry. What are you talking about? Oh, the link is entirely contained in the fragment. So it’s some SPA blog thing. I get it.
In my haste to initially get a blog started and published, I created it as a single HTML file with fragment identifiers / links for each post. Earlier today, sethops1’s valid feedback prompted me to restructure it as an index page with separate pages for each post.
Links to posts no longer contain URL fragments, but I kept the fragment-style links working with JavaScript.
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#206Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.
I don’t really have a reason to use WordPress anymore. I’m about halfway through switching my site over to something else that I can control with github and AI. Now these boats are mostly getting static files unless there’s a reason to show something else and even then the footprint is very small. There’s just not that much to hack.
I've done the same by scraping the HTML/JS/CSS off our own Wordpress site and sticking it in S3 (behind CloudFront, of course). It was a mild hassle at the time, but would take seconds with today's LLMs. It was a great decision and has been no hassle since, as we didn't really need a CMS, it was just the default for the person who did our design.
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#207Earlier quoted context omitted.
What is your way of detecting them? Just cat your way through your logs?
Almost lol: grep, sort and uniq. If I notice someone is hammering my employer's ecommerce site, I'll block them. It isn't required often so I've been reluctant to spend the time setting up fail2ban.
Is it a multi-server setup? If so, do you ssh into each machine and look at the logs?
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#208On average about 100 (TCP) requests hit my home router per minute doing various probing and scanning. Lots of checking for the telnet port obviously. Sometimes you can see a swarm of entirely different IPs scanning the full port range (probing the ports one-by-one). You'll see a lot of deepfield, censys-scanner, visionheight.com, shadowserver.io, etc., but also the usual suspects of Chinese or Russian IPs. With OpenW…
The easiest way to deal with the usual suspects is to just block the entire countries network range(s). There really is no reason they should be connecting to your home router anyway, and you lose nothing from blocking them. Sure their packets will still hit your router, but if they are dropped immediately at least you're not wasting a syn-ack on them.
> just block the entire countries network range(s)
Why not just block all the inbound connections you don't need? Is there a particular reason your firewall policy needs to be xenophobic?
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#209Earlier quoted context omitted.
Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.
I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!
Maybe you just have fail2ban properly set up.
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#210Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.
Numbers say that the number of attacks are increasing: https://radar.cloudflare.com/security/application-layer?date...