Why Is This Website Port Scanning Me?

Post by neop1x » Thu, May 21, 2020, 3:23 PM UTC

nucleardog wrote: post #370

loeg wrote: post #322

Earlier quoted context omitted.

Outside of DNS, the other reasons are about local networks, not 127.0/8. There's no good reason to permit port-scanning 127.0/8.

So remove "port scanning" since the only difference between port scanning and "legitimate" connection attempts is rate. Should websockets be able to connect to the local machine? In some cases that could be useful (even if something the kinds of people visiting this site might be uncomfortable with). E.g., a local daemon that listens for a websocket connection and a public web page that's used for managing it. I don'…

Post by jhhh » Thu, May 21, 2020, 6:13 PM UTC

gorhill wrote: post #382

jhhh wrote: post #327

Earlier quoted context omitted.

Ublock origin says it supports ABP filter rules which allow for whitelisting sites which seems like it should allow something approximating: ~site.com$websocket *,~site.com$websocket However this seems like it's invalid syntax because switching your example to this opens all websocket use back up tested via https://websocketstest.com/

That is not valid ABP filter syntax. This is what you want: *$websocket,domain=~site1.com For more than a single site: *$websocket,domain=~site1.com|site2.com|... I would personally suggest people to just enable advanced user mode and create rules such as: * 127.0.0.1 * blocked To block all request attempts to 127.0.0.1.

Post by sedatk » Fri, May 22, 2020, 4:39 AM UTC

jolmg wrote: post #360

sedatk wrote: post #354

Earlier quoted context omitted.

Port scanning is a brute force, over-reaching probing technique. A better analogy would be like visiting a shopping mall and trying to open every closed door you see, including the ones that say "authorized personnel only", "private", "do not enter" with an excuse like "I was trying to find out which shop was open".

I answered an almost identical reply, here[1]. > including the ones that say "authorized personnel only", "private", "do not enter" Basically, to answer you separately, an analogy like that doesn't represent TCP accurately. In your analogy, you can 1) see from afar for visual cues indicating whether access is being given to you, and 2) try opening it. Your argument is that doing 2 is invasive, because they can do 1.…

Post by m463 » Fri, May 22, 2020, 4:48 AM UTC

jrockway wrote: post #298

jolmg wrote: post #248

> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…

I think the dynamics of the Internet have shifted from the early days. Basically, HTTPS on port 443 is pretty much the only service that anyone intends to make publicly available. This is different from 30 years ago, when those same sites had HTTP, FTP, Gopher, a public Telnet server, a public NTP server, etc. and they wanted you to use them. It was very reasonable to look around back then, but nowadays anything that…

Post by problem_halting » Fri, May 22, 2020, 6:55 AM UTC