Hacker News

I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!

That sort of vulnerability scanning is at best legally dubious, and almost certainly illegal under CFAA and similar state statues when there's clear criminal intent. That's why the 2022 DOJ guidance regarding non-prosecution good faith security research was such a big deal at the time.

> IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...

From experience: this does happen regularly in some neighborhoods of some cities in the US, and even that isn't always an enforcement priority. So lack of enforcement on the internet, where most the perpetrators probably aren't even in a jurisdiction with an extradition treaty, isn't exactly surprising.

Unauthorized access is not legal, it's just not enforced in the slightest.

Illegal and actively enforced are different things. Report it to the hosting company originating the abuse and they usually don't care.

This is so true. Every junior sysadmin I have trained over the years (including myself) has had a “are we being attacked?!” moment when tasked with WAF report analysis, monitoring fail2ban logs, etc.

Monitoring WAN traffic really gets the paranoia juices flowing.

People or their agents must be accidentally committing or publishing their repository level secrets and configs with enough regularity that it’s worth scanning.

There are a few novel ones but I’ve been seeing most of them in my logs for longer than generative AI has existed. This isn’t remotely new, the vector is just getting bigger.

I, temporarly, banned some ip range. I didn't find a source for pinpointing countries; though I am interested. Could you point me to some sources which, deterministically, resolve to some countries? To my knowledge you can not reliably identify countries by ip since this would be dependent on DNS servers. Though I am just a application programmer!

Thanks in advance.

I run an open source honeypot that collects these botnet scans and produces blocklists.

Blocklist download and configuration: https://knock-knock.net/blocklist

Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net

API: http://knock-knock.net/api

> /commercial IP from legitimate users

No, because legitimate users do not just use residential and "commercial" IPs. Like me, right now

Yes but it’s not cheap. Maxmind and ipinfo etc sell a tier that tells you this information, then you can 403 based on it. But the price is nuts like $40,000 a year.

There are many possibilities but one of them could be some new vuln was released and they are looking for it. That would require looking at the URL's they are requesting. Botters run their own purpose built campaigns. Do you also have a summary of URL's requested by unique counts?

Problem here is there are not single fibers attaching (most) countries, but a bunch of them. If you control both the ingress and egress for some particular users it's possible, but if you don't then your probing packing may end up back in China with a lot of evidence of backscatter.

It's still not really anything special. Thousands isn't even large scale.

Any random bozo can trigger that.

Nah these are just the typical vuln scans that try all kinda basic shit, looking for anything commonly used AI tools included.