Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

knownagents.com

Post reply on HN
Print view View original

231–240 of 242 posts

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#231

Post by mzajc »

miah_ wrote: post #19
binaryturtle wrote: post #9

On average about 100 (TCP) requests hit my home router per minute doing various probing and scanning. Lots of checking for the telnet port obviously. Sometimes you can see a swarm of entirely different IPs scanning the full port range (probing the ports one-by-one). You'll see a lot of deepfield, censys-scanner, visionheight.com, shadowserver.io, etc., but also the usual suspects of Chinese or Russian IPs. With OpenW…

The easiest way to deal with the usual suspects is to just block the entire countries network range(s). There really is no reason they should be connecting to your home router anyway, and you lose nothing from blocking them. Sure their packets will still hit your router, but if they are dropped immediately at least you're not wasting a syn-ack on them.

> The easiest way to deal with the usual suspects is to just block the entire countries network range(s).

Keep in mind that this should be paired with an ASN blacklist - MaxMind also has an ASN mmdb for convenience - because IP address to country maps are almost entirely self-declared[0].

For example, Tencent (AS132203), which you almost certainly want to block, has ranges in 73 different countries per [1].

[0]: https://datatracker.ietf.org/doc/html/rfc8805

[1]: https://bgp.tools/as/132203#prefixes

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#232

Post by michaelbuckbee »

drewnick wrote: post #21
yabones wrote: post #6

Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.

Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.

Since most analytics is done with JS (Google Analytics, etc.) very little of this shows up in site visit stats.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#233

Post by dizhn »

Jskewel wrote: post #223

For those suggesting fail2ban as a solution, that's dinosaur software from the palaeolithic. If you have a website of any size then the number of bots will overwhelm the block list in days with their millions of unique IPs.

fail2ban has always just been a log cleaner.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#234

Post by ehnto »

b112 wrote: post #212
ehnto wrote: post #193

Earlier quoted context omitted.

Not that I follow my own advice, but a popped server can still be a liability for you. If you don't need it online I would take it down. Don't want to suddenly realise you've been an email spam node for several months.

Re-read the post. He converted the sites to static html.

If it's a computer publicly visible on the internet then it has an attack surface, not having a scripting language enabled reduces it a lot but not entirely. There is still a web server involved in a static site being served, amongst other services that computers often have by default.

If it's shared hosting, still a problem, just not theirs.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#235

Post by Saris »

ShinyLeftPad wrote: post #202
nik282000 wrote: post #191

Earlier quoted context omitted.

I went from 2k hits a day to 15k in the past week. Point a domain at your IP, use letsencrypt, post your domain on Reddit, github, x, etc. The bots will find you.

How letsencrypt "helps"?

Whenever a new certificate is issued the bots seem to all monitor that and immediately start scanning the new domain.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#236

Post by ehnto »

fragmede wrote: post #228
unclebucknasty wrote: post #217

Earlier quoted context omitted.

To GP's point, any connected server can become a liability, even if it is intended to just host static HTML (or for some other purpose).

I'm serving static sites via Cloudflare pages. Pretty sure that's gonna be actually static.

It's fine, I am just being a nit, but static doesn't mean zero code. There is still a server and program turning a web request into a response. But in your case it's not your problem, it's cloudflare's.

I only mentioned it in the assumption they had a VM or shared hosting, in which case it's worth thinking about.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#237

Post by nerdralph »

nik282000 wrote: post #191
nerdralph wrote: post #186

How can I attract more of these bots to my server? I want to test my Apache bad bot blocker. It uses basic header fingerprinting and h2 support to filter them. I get less than 5000 hits on an average day, and want a lot more.

I went from 2k hits a day to 15k in the past week. Point a domain at your IP, use letsencrypt, post your domain on Reddit, github, x, etc. The bots will find you.

I have a domain with an SSL cert. https://solarsi.ca/ I tried posting on /r/sysadmin asking for help testing a bot blocker, but a moderator quickly deleted the post, claiming it was marketing/promoting.

Thanks for the github suggestion; I'll add a repo for the bot blocker Apache config, and include the above server URL that I'm using to test the blocker.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#239

Post by cpburns2009 »

tommica wrote: post #207
cpburns2009 wrote: post #182

Earlier quoted context omitted.

Almost lol: grep, sort and uniq. If I notice someone is hammering my employer's ecommerce site, I'll block them. It isn't required often so I've been reluctant to spend the time setting up fail2ban.

Is it a multi-server setup? If so, do you ssh into each machine and look at the logs?

It's 3 servers so it's not too much hassle to ssh into them and check it manually.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#240

Post by cullenking »

inigyou wrote: post #215
cullenking wrote: post #197

Earlier quoted context omitted.

Not sure what you mean by your first comment - there is no technical reason that I know of that prevents a VPN provider from having their own ASN and address space. As for the latter comment....not sure what your implication is. Yes, bot/spam mitigation is whackamole, but there are consequences for not playing the game of whackamole. Luckily residential proxies are few and far between so far, but they will grow in po…

Majority of scraper traffic right now is from residential proxies

That’s not the pattern I am seeing, but I might be outside the norm. The majority of bot action (scraper, spam) comes from vpn providers by a long shot, ignoring (Chinese ASNs, Indian mobile ISPs etc). I see very little consumer isp action except cheap international providers, which are still swamped by vpn traffic.
Post reply on HN