Interesting thought: what if the idea of an open internet is over.
What if we're now moving into a world of strictly KYC. The same way "The Facebook" generated massive revenue by creating a KYC world.
Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
61–70 of 243 posts
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#62Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.
Opening port 80 and realizing the world is an anarchic warzone is a canonic rite of initiation for otherwise innocent backend devs and sysadmins.
This is so true. Every junior sysadmin I have trained over the years (including myself) has had a “are we being attacked?!” moment when tasked with WAF report analysis, monitoring fail2ban logs, etc.
Monitoring WAN traffic really gets the paranoia juices flowing.
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#63Earlier quoted context omitted.
Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.
I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!
Could be because of number of pages you have. At work we have several million public content pages, so a few badly behaving bots can already do a lot of damage.
For my personal website it’s 10x more bots but I barely notice because it’s a few pages.
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#64Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.
I am always surprised that its considered legal. IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...
Illegal and actively enforced are different things. Report it to the hosting company originating the abuse and they usually don't care.
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#65Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.
I am always surprised that its considered legal. IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...
That sort of vulnerability scanning is at best legally dubious, and almost certainly illegal under CFAA and similar state statues when there's clear criminal intent. That's why the 2022 DOJ guidance regarding non-prosecution good faith security research was such a big deal at the time.
> IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...
From experience: this does happen regularly in some neighborhoods of some cities in the US, and even that isn't always an enforcement priority. So lack of enforcement on the internet, where most the perpetrators probably aren't even in a jurisdiction with an extradition treaty, isn't exactly surprising.
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#66Earlier quoted context omitted.
I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!
I don't even have a domain name and I'm getting lots of hits.
Old and busted: serverless
New hotness: DNS-less
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#67Why would you voluntarily pretend to be a AI bot, when those have already a much higher chance of being blocked? Seems holly unproductive. Best hypothesis I can come up with is to somehow make the AI companies look bad, but they seem to be doing an excellent job at that themselves already by scraping everyone hundreds of times per hour over and over.
Most websites don't have an incentive to block AI bots to their main sites. Think businesses, government and community websites, nonprofits, etc.
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#68Earlier quoted context omitted.
I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!
I don't even have a domain name and I'm getting lots of hits.
I recently brought up a website on a never-before-seen .com domain. Within about 10 mins of bringing it up with a SSL certificate, Anthropic came knocking on the door requesting the front page. (Almost certainty due to them watching the Public Certificate Transparency logs)
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#69Earlier quoted context omitted.
Yes but it’s not cheap. Maxmind and ipinfo etc sell a tier that tells you this information, then you can 403 based on it. But the price is nuts like $40,000 a year.
I work for IPinfo. We offer IPinfo Lite for free. With a little bit of time in identifying the ASNs, you can implement a decent way to block a good number of bots fairly easily using the free data alone.
Good to know, thank you. Would you do this by fully blocking particular ASNs? Or something more granular?
Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
#70Earlier quoted context omitted.
Opening port 80 and realizing the world is an anarchic warzone is a canonic rite of initiation for otherwise innocent backend devs and sysadmins.
This is so true. Every junior sysadmin I have trained over the years (including myself) has had a “are we being attacked?!” moment when tasked with WAF report analysis, monitoring fail2ban logs, etc. Monitoring WAN traffic really gets the paranoia juices flowing.
I remember when you could stand up a website and no bots would scrape it or scan it. It was a lovely time. No one had firewalls or antivirus and things were working fine until the worms and viruses started coming. You could be confident that your guests were real, so much so we had guest counters on many public sites.