3 ms·
What's worse is when you get bots blasting HTTP traffic at every open port, even well known services like SMTP. Seriously, it's a mail server. It identified its
by ralferoo 1y ago
What's worse is when you get bots blasting HTTP traffic at every open port, even well known services like SMTP. Seriously, it's a mail server. It identified itself as soon as the connection was opened, if they waited 100ms-300ms before spamming, they'd know that it wasn't HTTP because the other side wouldn't send anything at all if it was. There's literally no need to bombard a mail server on a well known port by continuing to send a load of junk that's just going to fill someone's log file.
- JdeBP 1y agoI remember putting dummy GET/PUT/HEAD/POST verbs into SMTP Relay softwares a quarter of a century ago. Attackers do not really save themselves time and money by being intelligent about this. So they aren't. There are attackers out there that send SIP/2.0 OPTIONS requests to the GOPHER port, over TCP.
- sidewndr46 1y agoIt's even funnier when you realize it is a request for a known exploit in WordPress. Does someone really run that on port 22?
- Sohcahtoa82 1y agoI HAVE heard of someone that runs SSH on port 443 and HTTPS on 22. It blocks a lot of bots, but I feel like just running on a high port number (10,000+) would likely do better.
- mjmas 1y agoI have a service running on a high port number on just a straight IPv4 and it does get a bit of bot traffic, but they are generally easy to filter out when looking at logs (well behaved ones have a domain in their User-Agent and bingbot takes my robots.txt into account. I dont think I've seen the Google crawler. Other bots can generally be worked out as anything that didn't request my manifest.json a few seconds after loading the main page)