Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

knownagents.com

Post reply on HN
Print view View original

91–100 of 244 posts

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#91

Post by binaryturtle »

heywire wrote: post #53
binaryturtle wrote: post #9

On average about 100 (TCP) requests hit my home router per minute doing various probing and scanning. Lots of checking for the telnet port obviously. Sometimes you can see a swarm of entirely different IPs scanning the full port range (probing the ports one-by-one). You'll see a lot of deepfield, censys-scanner, visionheight.com, shadowserver.io, etc., but also the usual suspects of Chinese or Russian IPs. With OpenW…

This is one reason I don’t mind that I’m behind CGNAT.

That's the only advantage of CGNAT I can think of. :D

(You still could get poked from the other users' hosts behind the ISP's NAT, of course.)

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#92

Post by econ »

andai wrote: post #43
drewnick wrote: post #21

Earlier quoted context omitted.

Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.

I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!

Humans never visit but I have some websites with ancient cms's. When I got bored playing with them I download the html, change the extensions to php and replace the site with a static copy. People then tirelessly try to hack it since they have laundry lists of known vulnerabilities. (Now that I think about it I regret not making the admin area public for added nostalgia.)

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#93

Post by lostlogin »

thesuitonym wrote: post #55
tommyage wrote: post #45

Earlier quoted context omitted.

I, temporarly, banned some ip range. I didn't find a source for pinpointing countries; though I am interested. Could you point me to some sources which, deterministically, resolve to some countries? To my knowledge you can not reliably identify countries by ip since this would be dependent on DNS servers. Though I am just a application programmer! Thanks in advance.

Your router doesn't care about their DNS settings. IP addresses are very easy to tie back to countries. The reason they say it's not reliable is because it's trivial to spoof the country, but even so, a lot of attackers don't even bother. It's sort of like the Nigerian prince scam calls: if you're wise enough to block Russia, you're not worth their time. Your firewall vendor should supply you with country lists, just…

I wonder if adding the US is now sensible.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#94

Post by VladVladikoff »

Bender wrote: post #74
basilikum wrote: post #18

Earlier quoted context omitted.

Much more than 0.001% of people care about their privacy or (the larger portion) do not have unfiltered access to the internet.

I second this. When I have tested blocking VPS/data-centers to my silly blog there were about a dozen people on HN [1] that could not view my site out of the roughly ~17,000 (not counting bots) that could. It's not a big number but those are real people and they count. I am going to move full blocking to a test node that people can play with but I have to finish working with Claude to revise someones repo is is no lo…

What did you use for detection?

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#95

Post by skinfaxi »

djkurlander wrote: post #15
codegeek wrote: post #12

Earlier quoted context omitted.

Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.

I run an open source honeypot that collects these botnet scans and produces blocklists. Blocklist download and configuration: https://knock-knock.net/blocklist Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net API: http://knock-knock.net/api

This looks cool, where can I find the source?

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#96

Post by VladVladikoff »

yardstick wrote: post #76
VladVladikoff wrote: post #14

Earlier quoted context omitted.

Yes but it’s not cheap. Maxmind and ipinfo etc sell a tier that tells you this information, then you can 403 based on it. But the price is nuts like $40,000 a year.

Open source works just fine for this - take a look at geoacumen-country https://github.com/geoacumen/geoacumen-country

Isn’t that only countries though? They were talking about detecting VPS

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#97

Post by dewey »

ChillyCapy wrote: post #87

Fake Googlebot visits are #1 in website logs I've been working on. At the beginning I was fighting with them using Cloudflare ASN block rules or their managed Bot Fight mode but it appeared to be not only pointless, but also harmful for my websites. Bot Fight mode randomly started blocking real Bing / Google / OpenAI crawlers what wasted crawling budget and discouraged crawlers to revisit updated pages. Sometimes it'…

For Google it's pretty straight forward to throw away fake crawlers by just only allowing their published list of crawler IPs so you don't accidentally allow someone from a random GCP IP to crawl you if unwanted (https://developers.google.com/crawling/docs/crawlers-fetcher...).

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#98

Post by djkurlander »

skinfaxi wrote: post #95
djkurlander wrote: post #15

Earlier quoted context omitted.

I run an open source honeypot that collects these botnet scans and produces blocklists. Blocklist download and configuration: https://knock-knock.net/blocklist Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net API: http://knock-knock.net/api

This looks cool, where can I find the source?

It's on github with an MIT license: https://github.com/djkurlander/knock-knock. Have fun!

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#99

Post by Bender »

VladVladikoff wrote: post #94
Bender wrote: post #74

Earlier quoted context omitted.

I second this. When I have tested blocking VPS/data-centers to my silly blog there were about a dozen people on HN [1] that could not view my site out of the roughly ~17,000 (not counting bots) that could. It's not a big number but those are real people and they count. I am going to move full blocking to a test node that people can play with but I have to finish working with Claude to revise someones repo is is no lo…

What did you use for detection?

The complaints in the thread. I am aware the lurkers would not have said anything.

Re: Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

#100

Post by Bender »

nubinetwork wrote: post #89
Bender wrote: post #73

Earlier quoted context omitted.

There are several methods. [1] The most aggressive method-02 and method-03 on my document will block VPS and some data-centers but that also means it will block some legit users that are on a VPN. Most VPNs transit a data-center. If experimenting with these methods use a test server that you do not care about and set up a dummy site and ask people in your circle of friends to test it. I have to step away for a bit bu…

Per your link... > block http 1.1, real users only use 2.0 Chrome on android and Firefox on linux both appear to use 1.1 still...

By default they use 2.0 [1] unless someone or an addon disables it or unless the person is on a really old version. OperaMini however will use 1.1. No idea if anyone here uses OperaMini.

There are some reader apps that act as a proxy that only support http/1.1. Be careful, some of those are not just readers and do not trust what they claim to be the source code. Some of them are created by cute and fuzzy bunnies.

There are a number of botters on HN, some that control residential and phone browser-hijacked systems. One was sending me playful messages the other day. I enjoyed the bot block-jousting with them.

[1] - https://caniuse.com/http2

Post reply on HN