Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

knownagents.com

Post reply on HN
Print view View original

81–90 of 244 posts

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#81

Post by random29ah »

tommyage wrote: post #45
miah_ wrote: post #19

Earlier quoted context omitted.

The easiest way to deal with the usual suspects is to just block the entire countries network range(s). There really is no reason they should be connecting to your home router anyway, and you lose nothing from blocking them. Sure their packets will still hit your router, but if they are dropped immediately at least you're not wasting a syn-ack on them.

I, temporarly, banned some ip range. I didn't find a source for pinpointing countries; though I am interested. Could you point me to some sources which, deterministically, resolve to some countries? To my knowledge you can not reliably identify countries by ip since this would be dependent on DNS servers. Though I am just a application programmer! Thanks in advance.

Getting it directly from IANA is always the best approach.

Here is a "simplified" version in various formats.

https://github.com/HotCakeX/Official-IANA-IP-blocks

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#82

Post by deaton »

yabones wrote: post #6

Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.

Most servers with port 25565 open get hits from either Minecraft griefer bots, or from a bot that looks for that port and warns anyone on that server about the risks of leaving that port open. It doesn't take a huge scale operation to spam every IPv4 address in the world, there are only 2^32 of them, and even then many of those addresses are reserved.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#86

Post by jareklupinski »

drewnick wrote: post #21
yabones wrote: post #6

Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.

Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.

imagine having a KPI tied to cash bonuses based on that...

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#87

Post by ChillyCapy »

Fake Googlebot visits are #1 in website logs I've been working on. At the beginning I was fighting with them using Cloudflare ASN block rules or their managed Bot Fight mode but it appeared to be not only pointless, but also harmful for my websites. Bot Fight mode randomly started blocking real Bing / Google / OpenAI crawlers what wasted crawling budget and discouraged crawlers to revisit updated pages.

Sometimes it's better to not fight with bots actively but harden environment and only react for the worst offenders.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#88

Post by herbst »

ChillyCapy wrote: post #87

Fake Googlebot visits are #1 in website logs I've been working on. At the beginning I was fighting with them using Cloudflare ASN block rules or their managed Bot Fight mode but it appeared to be not only pointless, but also harmful for my websites. Bot Fight mode randomly started blocking real Bing / Google / OpenAI crawlers what wasted crawling budget and discouraged crawlers to revisit updated pages. Sometimes it'…

[dead]

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#89

Post by nubinetwork »

Bender wrote: post #73
codegeek wrote: post #12

Earlier quoted context omitted.

Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.

There are several methods. [1] The most aggressive method-02 and method-03 on my document will block VPS and some data-centers but that also means it will block some legit users that are on a VPN. Most VPNs transit a data-center. If experimenting with these methods use a test server that you do not care about and set up a dummy site and ask people in your circle of friends to test it. I have to step away for a bit bu…

Per your link...

> block http 1.1, real users only use 2.0

Chrome on android and Firefox on linux both appear to use 1.1 still...

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#90

Post by esseph »

hamdingers wrote: post #56
andai wrote: post #43

Earlier quoted context omitted.

I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!

Get a letsencrypt cert, I always get a massive wave of vulnerability probers after renewing.

Because your certificate shows up in the global chain, which triggers all kinds of automated things including bots
Post reply on HN