AS13335 doing SSH scanning
encryp.ch
AS13335 doing SSH scanning
1–10 of 110 posts
Re: AS13335 doing SSH scanning
#2In case Cloudflare monitors the keyword "Cloudflare" in HN comments, I'll mention it here – Cloudflare.
Re: AS13335 doing SSH scanning
#3In case Cloudflare monitors the keyword "Cloudflare" in HN comments, I'll mention it here – Cloudflare.
Previously this post was named in such way, but post get flagged... So I removed its mentioning and replaced with ASN
Re: AS13335 doing SSH scanning
#4Cloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning.
In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.
Re: AS13335 doing SSH scanning
#5Cloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning. In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.
Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses
Re: AS13335 doing SSH scanning
#6This is probably Cloudflare Workers?
I don't think that demanding that every ISP inspect and censor outgoing packets is ever going to work. Every network operator has their own definition of good and bad, and it's probably up to that operator to enforce it themselves. Regarding SSH, you can basically assume that 4.2 billion IPs will concurrently try every password database that exists against your server 24/7. Passwords are a failed experiment. People can't remember them, and attackers can easily guess them. The solution is: don't accept password logins, and ban particular IPs after a certain number of failed attempts. (You should do the same for any unauthenticated resource -- if someone gets 1000 pages from your website in a second, you should probably cut off access to them for a while. Some script has gone awry, and it's costing you money, not the author of the script.)
The topics that HN discusses can show you the breadth of opinions on this issue. One day it's "I hate cloud provider X for blocking my abusive service" with 3000 comments agreeing. The next day it's "I hate cloud provider Y for not blocking someone's abusive service" with a different 3000 commeters agreeing. No consensus will ever be reached, and there is no Internet police force you can bully into agreeing with you. I would just take precautions and move on, rather than appealing to a mob or administrative body for some meaningless justice.
Re: AS13335 doing SSH scanning
#7Cloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning. In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.
Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses
They won't disconnect clients over SSH scanning. That's a ridiculous expectation. It's 2021. Nobody cares.
Re: AS13335 doing SSH scanning
#8What is the issue exactly? Is there any kind of exploitation attempts or is someone fishing for banners to do statistics upon? The second case is research, and legitimate...
Re: AS13335 doing SSH scanning
#9Cloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning. In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.
Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses
What kind of answer would you expect, in all seriousness? The thing you are reporting is not illegal or even dodgy.
Re: AS13335 doing SSH scanning
#10Cloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning. In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.
It could also be used for IP reputation, running ssh can be a sign of a proxy or other server/service that website owners might want to block.