| ▲ | Bender 2 hours ago |
| Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies). On that note, do not trust the linked source code but rather decompile the live code your phone is running and have AI analyze it. |
|
| ▲ | codegeek 2 hours ago | parent | next [-] |
| Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc. |
| |
| ▲ | djkurlander an hour ago | parent | next [-] | | I run an open source honeypot that collects these botnet scans and produces blocklists. Blocklist download and configuration: https://knock-knock.net/blocklist Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net API: http://knock-knock.net/api | |
| ▲ | basilikum an hour ago | parent | prev | next [-] | | > /commercial IP from legitimate users No, because legitimate users do not just use residential and "commercial" IPs. Like me, right now | | | |
| ▲ | VladVladikoff an hour ago | parent | prev [-] | | Yes but it’s not cheap. Maxmind and ipinfo etc sell a tier that tells you this information, then you can 403 based on it.
But the price is nuts like $40,000 a year. | | |
| ▲ | sparkling a minute ago | parent | next [-] | | Focsec.com IP database for offline use (datacenters, VPNs, proxies, bots) runs around $1k/month for internal-only use. | |
| ▲ | KomoD 41 minutes ago | parent | prev [-] | | You don't need to spend anywhere near $40k a year to get that info... You don't even need to spend $1 | | |
|
|
|
| ▲ | gavinhking 2 hours ago | parent | prev | next [-] |
| Yeah, that's exactly what these visits are: faked user agents that fail IP verification or Web Bot Auth. What's interesting is the surge across so many websites in the last week. |
| |
| ▲ | Bender 2 hours ago | parent [-] | | There are many possibilities but one of them could be some new vuln was released and they are looking for it. That would require looking at the URL's they are requesting. Botters run their own purpose built campaigns. Do you also have a summary of URL's requested by unique counts? | | |
| ▲ | gavinhking 2 hours ago | parent [-] | | Looks like many of the paths relate to AI coding tools. There are some examples below the chart | | |
| ▲ | hluska 37 minutes ago | parent [-] | | You keep repeating this about a small minority of the tools that were posted. |
|
|
|
|
| ▲ | bflesch 2 hours ago | parent | prev [-] |
| Same for the origin IP address. The fiber leaving your country is tapped, and those people can inject packets with any origin IP that they want. Your ISP has no way to check if their peer actually received a certain packet from a certain country or not. From a technical perspective, all this "china/russia" attribution is built on a quite shaky foundation. As a sysadmin you'd never know if it would be the British crown attacking your European company instead. Not minimizing nation state cyber crime here, but the packet goes through many hands with different incentives. |
| |
| ▲ | pixl97 an hour ago | parent [-] | | Problem here is there are not single fibers attaching (most) countries, but a bunch of them. If you control both the ingress and egress for some particular users it's possible, but if you don't then your probing packing may end up back in China with a lot of evidence of backscatter. | | |
| ▲ | bflesch 18 minutes ago | parent [-] | | I'd be surprised if there is a single route from EU to non-EU countries which does not pass through British control. |
|
|
