Visualizing malicious IP addresses • Hacker News Board

Re: Visualizing malicious IP addresses

#41

Post by Gigachad » Fri, Apr 26, 2024, 5:16 AM UTC

ies7 wrote: post #28

> Interesting! We can see the most locations in India, Indonesia, and China as well as a significant number in the US and Europe. Are these because the bad guys are in there or just because of the population size? China, India, US, and Indonesia are the top four of the most populous country and also 4 countries with most internet users. Even the size of 10% of Indonesian internet users are almost the entire Taiwan po…

I doubt most of these scans come from the attackers network. This is probably just a map of where the poorly secured CCTV cameras and IoT washing machines are.

Re: Visualizing malicious IP addresses

#42

Post by bradley13 » Fri, Apr 26, 2024, 5:30 AM UTC

dfex wrote: post #29

> Upon closer inspection of Asia, we can notice a significant number of addresses located in South Kora, (and possibly North Korea?), as well as in Taiwan. > I was surpised to see that the distribution of attacks is extremely uneven with most of it concentrated in parts of Asia, Europe, and the US, and (almost) none from South America, Middle East, and Russia. Aside from the casual stereotyping of bad actors here, th…

Not seeing how this is stereotyping. He is just presenting his results. Whether those results stem from direct attacks or botnets? He doesn't even speculate.

When I ran public servers a few years ago, I saw similar results. Since the company had no customers in Asia, we IP-blocked the entire continent.

Re: Visualizing malicious IP addresses

#43

Post by Moru » Fri, Apr 26, 2024, 5:33 AM UTC

wiradikusuma wrote: post #15

Holy moly! That explains why I frequently get captcha when using residential internet in Jakarta. I don't see those captcha when accessing from e.g. Kuala Lumpur or Singapore. Is the information in the article actionable? E.g. can I complain to someone with authority?

No, it's just a map of all hacked IoT devices in the world, it's not where the actual hacker is.

Re: Visualizing malicious IP addresses

#44

Post by supriyo-biswas » Fri, Apr 26, 2024, 5:34 AM UTC

dfex wrote: post #29

> Upon closer inspection of Asia, we can notice a significant number of addresses located in South Kora, (and possibly North Korea?), as well as in Taiwan. > I was surpised to see that the distribution of attacks is extremely uneven with most of it concentrated in parts of Asia, Europe, and the US, and (almost) none from South America, Middle East, and Russia. Aside from the casual stereotyping of bad actors here, th…

I found the information about the attackers’ quite interesting, because it also seems to disagree with Cloudflare data and my personal experience[1] which shows the US to be the largest originator of attacks.

[1] https://radar.cloudflare.com/

Re: Visualizing malicious IP addresses

#45

Post by jkrejcha » Fri, Apr 26, 2024, 5:37 AM UTC

mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

>180.101.88.232

Amusingly I recognize those IPs by that specific prefix as well, basically that entire /24 (at the very least) appears to be an absolutely massive source of the SSH login attempts.

Small world, I guess

Re: Visualizing malicious IP addresses

#46

Post by PhilipRoman » Fri, Apr 26, 2024, 5:39 AM UTC

IAmGraydon wrote: post #7

wsintra2022 wrote: post #6

Interesting, if it’s an issue you could try port knocking to prevent the constant attempts

Anyone who has run an SSH server on the default port knows that you’ll get hundreds or thousands of login attempts per day. Changing the port to something less obvious and running fail2ban is enough to mitigate most of it. They’re just looking for low hanging fruit.

Changing the default port - yeah, works wonders for reducing noise. But I don't understand why people run fail2ban. Nobody is going to be brute forcing a ssh login, all it does is add another moving part very close to a security boundary for very little gain.

Re: Visualizing malicious IP addresses

#47

Post by gnabgib » Fri, Apr 26, 2024, 5:47 AM UTC

PhilipRoman wrote: post #46

IAmGraydon wrote: post #7

Earlier quoted context omitted.

Anyone who has run an SSH server on the default port knows that you’ll get hundreds or thousands of login attempts per day. Changing the port to something less obvious and running fail2ban is enough to mitigate most of it. They’re just looking for low hanging fruit.

Changing the default port - yeah, works wonders for reducing noise. But I don't understand why people run fail2ban. Nobody is going to be brute forcing a ssh login, all it does is add another moving part very close to a security boundary for very little gain.

Have you recently run a server? It takes a week-month before your ssh port is published on shodan/binaryedge/censys/criminalIP and other dodgy scanners.. and then you can expect constant attention, and yes.. 14691 attempted logins for every username possible (even though password login is turned off) from the same IP (usually a VPN, tor exit, or "crowdsourced VPN")

Re: Visualizing malicious IP addresses

#48

Post by out-of-ideas » Fri, Apr 26, 2024, 5:51 AM UTC

bradley13 wrote: post #42

dfex wrote: post #29

> Upon closer inspection of Asia, we can notice a significant number of addresses located in South Kora, (and possibly North Korea?), as well as in Taiwan. > I was surpised to see that the distribution of attacks is extremely uneven with most of it concentrated in parts of Asia, Europe, and the US, and (almost) none from South America, Middle East, and Russia. Aside from the casual stereotyping of bad actors here, th…

Not seeing how this is stereotyping. He is just presenting his results. Whether those results stem from direct attacks or botnets? He doesn't even speculate. When I ran public servers a few years ago, I saw similar results. Since the company had no customers in Asia, we IP-blocked the entire continent.

the distribution looks spot on for what it used to look back in late 2000's as well from my collection of memories (minus south america, russia)

Re: Visualizing malicious IP addresses

#49

Post by miyuru » Fri, Apr 26, 2024, 5:59 AM UTC

unraveller wrote: post #17

If you're lucky enough to have a big ISP with a single big block of IP addresses that never changes you can disallow all other ranges on your VPS admin ports and only have to worry about VPNing through that ISP. I guess you could block the main country offenders but you'd have to pay an API to keep up with the IP allocations to be sure.

I just use IPv6 and only allow my ISPs single /32 block. Its neat that IPv6 has cleaned the mess of IPv4 having different IP blocks all over.

My prefix is dynamic, If it was static it would be more secure.

And also I have fail2ban for good measure.

Re: Visualizing malicious IP addresses

#50

Post by ludovicianul » Fri, Apr 26, 2024, 6:01 AM UTC

A few years ago I've built a more simple visualization similar to this one with the attacks on the host the application was already deployed: https://github.com/ludovicianul/geolog. China was mostly leading, but there were many from US and Europe.