Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visualizing malicious IP addresses

romeov.github.io

Post reply on HN
Print view View original

71–80 of 124 posts

Re: Visualizing malicious IP addresses

#71

Post by viraptor »

bauruine wrote: post #37
mo_42 wrote: post #25

It's not so hard to use Tor for that. I wonder how the Tor exit nodes are distributed across the globe and see how that correlates or not.

I don't have exactly what you want but you would be very disappointed by the result anyway. Tor isn't as nefarious as people tend to believe. [bauruine@tp:projects/misc]$ python check_ip_tor.py /tmp/malicious_ips.txt Got a total of 6303 malicious IPs Of which 15 are Tor relays Edit: Small addendum here are the worst 5 ASNs. 1607 TENCENT-NET-AP-CN 738 DIGITALOCEAN-ASN 483 KIXS-AS-KR 205 GOOGLE-CLOUD-PLATFORM 115 OVH

Stats from my service: ~92% of fake / auto user registrations comes from tor exits. (Or would, without blocking)

Re: Visualizing malicious IP addresses

#73

Post by ayewo »

mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

That IP block (180.101.88.0/24) also makes a showing at the top of the stats [1] for https://brute.fail/

Previous HN discussion for brute.fail [2].

1: https://brute.fail/top.txt

2: https://news.ycombinator.com/item?id=36169954

Re: Visualizing malicious IP addresses

#75

Post by mr_mitm »

Joel_Mckay wrote: post #66
midnight_shaman wrote: post #63

I always install fail2ban on publicly exposed machines, especially if ssh is enabled. It won't block new malicious IPs but at least it will stop bruteforce attacks coming from each IP

Sure, but most people have had do the walk of shame to a local coffee shop when someone inevitably trips the ban on your own network. A proper firewall port-knock set interleaved with 5 day ban tripwire port rules is effective at mitigating distributed brute-forcing. However, a ssh route whitelist rule set with SSL or iodine tunnel traffic priority is probably more important (when someone saturates the bandwidth tryi…

Port knocking is one of those things that sound like a good idea, but there are many possible footguns. And why is it that there is no one consensus (or "blessed") implementation?

The implementation by Moxie seems interesting, but needless to say that Python 2 is an instant no-go: https://github.com/moxie0/knockknock

It hasn't been updated in 12 years, so why is it that there seems almost no real interest in a solid port knocking implementation?

Re: Visualizing malicious IP addresses

#76

Post by KomoD »

PhilipRoman wrote: post #46
IAmGraydon wrote: post #7

Earlier quoted context omitted.

Anyone who has run an SSH server on the default port knows that you’ll get hundreds or thousands of login attempts per day. Changing the port to something less obvious and running fail2ban is enough to mitigate most of it. They’re just looking for low hanging fruit.

Changing the default port - yeah, works wonders for reducing noise. But I don't understand why people run fail2ban. Nobody is going to be brute forcing a ssh login, all it does is add another moving part very close to a security boundary for very little gain.

> Nobody is going to be brute forcing a ssh login

Uh what? Yes people do...

Re: Visualizing malicious IP addresses

#77

Post by ayewo »

reincoder wrote: post #39

You can use IPinfo's IP map ( https://ipinfo.io/tools/map ) or IP summary tool ( https://ipinfo.io/tools/summarize-ips ). Both of these services support sending IP addresses via an API endpoint and can handle up to 500k IP addresses. You can also share the report via URL.

Thanks for the tip. I'm also working on a similar analysis where I need to geolocate a bunch of IP addresses at once.

Re: Visualizing malicious IP addresses

#78

Post by ajsnigrutin »

> Finding the location of each attacker.

...of the attacking IP address, not attacker...

If I, living in a small EU country, wanted to "hack" my neighbour across the street, I sure as hell wouldn't use my home IP address, tied to my account at my ISP, which has my name and address.

I'd probably try to find an "IP" (VM, vpn, or whatever) in a country that's not really friendly about giving "ip address data" to our authorities.

On the other hand, I wouldn't use a chinese IP in china, if I lived there and wanted to hack my neighbour over there.

Re: Visualizing malicious IP addresses

#79

Post by dotancohen »

mianos wrote: post #56
dotancohen wrote: post #52

Earlier quoted context omitted.

> I use a tarpit on all ssh I would love to hear more about your approach, if that's not sensitive. My Gmail username is the same as my HN username if you prefer. Thank you!

I run an N100 with LXD so I have a container running one of the many ssh tar pits and point 22 and a bunch other ports to it. It simulates an ssh login that very slowly sends ssh banner lines in the connection protocol, endlessly, until they disconnect. It commonly thought that they do nothing, but they seem to keep TCP connections open for quite a long time. A assume a hand written scanning client could detect and m…

Thanks. Yes, I have heard of such an approach, I did not know that it is called a tarpit. I just googled the idea and found Endlessh, I'll try it. Thank you.

Re: Visualizing malicious IP addresses

#80

Post by jeroenhd »

iforgotpassword wrote: post #58
mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

It's not illegal to try to log in to an ssh server. Or many. Apart from that I think the map from the article is mostly matching the number of internet-connected devices per country/region. So I think you can replace "some" by "almost all" in your statement. I mean, find a vulnerable iot device, use it for scanning/botnet.

It is where I live. If I know your username and password, using those credentials knowing you didn't intend to share them would be a crime.

Of course, the probability of someone getting arrested for logging into your SSH server is as close to 0 as you can possibly get, but that doesn't make it legal.

Post reply on HN