9 ms·

Here are some examples. They are probing the website for vulnerabilities in web frameworks that I am not using. The probes are generating a lot of logs, incorre

• mousetree 4y ago
  This type of traffic is very common. We see thousands of these every day. A quick and easy solution to this would be to use Cloudflare's WAF. Would block most of this traffic before it reaches you.
  • amony 4y ago
    Thank you. I would prefer to maintain full control of access to the site and not trust a large vendor such as CF. I know they have mechanisms that would stop this, but they may also impact normal users in a negative way.
    • lbotos 4y ago
      if you want to remain in control, then do fire off abuse reports and consider firewalling off those IPs.
    • mousetree 4y ago
      Could you elaborate on how they would impact normal users in a negative way? We rely heavily on CF so would be good to be knowledgeable about such things.
• jffry 4y ago
  I run a publicly accessible web service, and get this stuff all the time. My service happens to be fronted by nginx, so over time I accumulate config to match these and drop connections and drop from the logs entirely: location /wp-admin { access_log off; log_not_found off; return 444; } (444 is a nonstandard error code that tells nginx to just close the connection, don't respond at all; if you want to be more mischievous you could return 301 "https://nsa.gov https://nsa.gov")
  • DoctorOW 4y ago
    Yeah maybe spamming the NSA with a bunch of random bots whose only common attribute is your domain in the referrer tag is a bad idea.
    • KMnO4 4y ago
      I don’t think it’s illegal to redirect anyone anywhere. Either way, 301s don’t modify the referrer so they wouldn’t be able to tell.
      • bell-cot 4y ago
        I'm thinking that legal/illegal might not matter so much if you happen to annoy somebody at the NSA. And betting that they wouldn't be able to tell might prove regrettably over-optimistic.
• Symbiote 4y ago
  Just ignore them. Log analyser tools will exclude them from reports. It's only worth reporting abuse if there's something the ISP might do about it. Report a hacked server hosting malware etc. Don't bother for this.
• toast0 4y ago
  These aren't really actionable, it's part of the noise floor. Scanners gonna scan, etc. If you send an abuse report for these and it's processed, the user is going to tell the ISP, yeah, I'm running a vulnerability scan as a public service, and the scans are going to continue. You can put rules like someone said or you can ignore it.
  • bink 4y ago
    While some scans might come from that actual host owners, the vast majority are coming from compromised systems. If the ISP is responsible and investigates they will be shut off. Most types of scanning also violate the terms of service for almost all ISPs so even if the owner does claim it's a public service there's a decent chance they'll be shut off. If the scanner is brute-forcing or trying to exploit known vulnerabilities, for example. I know a lot of people will find this to be wishful thinking. I've run security for some fairly large businesses and reported more than my share of compromised hosts. Obviously we don't report every scanner because it's time consuming and the cost/benefit isn't there, but the percentage of companies that respond is far more than zero. I would say though, that you're less likely to get a response from a Whois contact for the IP than from a domain contact or a contact listed on the primary website of the domain owner. Whois contacts get so much spam they often go un-monitored.
    • rosnd 4y ago
      The kind of scanning visible in those logs has already been reported by a ton of automatic reporters.