5 ms·
I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!
by andai 3mo ago
I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!
- 0xdeadbeefbabe 3mo agoI don't even have a domain name and I'm getting lots of hits.
- xplt 3mo agoOld and busted: serverless New hotness: DNS-less
- 0xdeadbeefbabe 3mo agoYeah it's even superior to smol web in some circles. It's not that much longer than a phone number.
- inigyou 3mo agoAh yes my phone number is 2602 1337 ABCD CAFE 3542 77FF FE12 3456 See? It's quite short.
- voidUpdate 3mo agoSome people still use ipv4
- jasonjayr 3mo agoI recently brought up a website on a never-before-seen .com domain. Within about 10 mins of bringing it up with a SSL certificate, Anthropic came knocking on the door requesting the front page. (Almost certainty due to them watching the Public Certificate Transparency logs)
- andai 3mo agoHow do you know who's visiting? Reverse IP lookups? Or do they announce it in the headers?
- jasonjayr 3mo agoI saw it via the User-agent header + confirmed via IP ownership lookup.
- dawnerd 3mo agoHad a bit setup a new Wordpress install before I could lock it down. I was very confused why a brand new install didn’t give me the setup page before seeing in the logs someone had automated it. Pure evil to be scraping new renewals and dns changes to look for this kinda stuff. For the record I thought I had this site behind basic auth.
- 01284a7e 3mo ago"Public Certificate Transparency logs"... The scam of "everyone should have SSL" right here, ladies and gentlemen.
- hamdingers 3mo agoGet a letsencrypt cert, I always get a massive wave of vulnerability probers after renewing.
- esseph 3mo agoBecause your certificate shows up in the global chain, which triggers all kinds of automated things including bots
- mmh0000 3mo agoIt's all TLS certs, because they show up in the Transparency Log[1] You can watch a live stream of it here: https://bencevans.io/security/certificate-stream https://bencevans.io/security/certificate-stream [1] https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency
- doubled112 3mo agoI use subdomains and a wildcard cert to partly obfuscate this.
- RulerOf 3mo agoI do the same, but I switched from cert-per-subdomain a couple of years ago. They're either using Passive DNS logs or a historical dataset.
- unethical_ban 3mo agoWhen I stood up some sites last year, I used codenames for the subdomains thinking I was obfuscating a little. I didn't know about the transparency logs until months later.
- martyvis 3mo agoTIL about Certificate Transparency (they didn't teach that in security school)
- bigbuppo 3mo ago
- whstl 3mo agoCould be because of number of pages you have. At work we have several million public content pages, so a few badly behaving bots can already do a lot of damage. For my personal website it’s 10x more bots but I barely notice because it’s a few pages.
- econ 3mo agoHumans never visit but I have some websites with ancient cms's. When I got bored playing with them I download the html, change the extensions to php and replace the site with a static copy. People then tirelessly try to hack it since they have laundry lists of known vulnerabilities. (Now that I think about it I regret not making the admin area public for added nostalgia.)
- ehnto 3mo agoNot that I follow my own advice, but a popped server can still be a liability for you. If you don't need it online I would take it down. Don't want to suddenly realise you've been an email spam node for several months.
- b112 3mo agoRe-read the post. He converted the sites to static html.
- unclebucknasty 3mo agoTo GP's point, any connected server can become a liability, even if it is intended to just host static HTML (or for some other purpose).
- fragmede 3mo agoI'm serving static sites via Cloudflare pages. Pretty sure that's gonna be actually static.
- unclebucknasty 3mo agoYou're running Cloudflare Pages on a home server?
- ehnto 3mo agoIt's fine, I am just being a nit, but static doesn't mean zero code. There is still a server and program turning a web request into a response. But in your case it's not your problem, it's cloudflare's. I only mentioned it in the assumption they had a VM or shared hosting, in which case it's worth thinking about.
- thenthenthen 3mo agoI never had this issue really… until two years ago, new website new host… boom, hugged to death by thousands of bots per second. This is on an alicloud vps.
- inigyou 3mo agoyeah someone told me he had a single static HTML homepage and used up his entire 10TB/month traffic limit from bots hitting it.
- ryukoposting 3mo agoI always had a decent bit of background noise, I think hosting on AWS comes with that. But after someone linked to me on hackaday the bot traffic went through the roof. One link to you from a noteworthy website, and all bets are off forever.
- outofpaper 3mo agoMaybe you just have fail2ban properly set up.
- lelanthran 3mo ago> I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me! You're running the wrong stack - I, myself, find that simply having a static file website is enough to cut down on the traffic. You need to run something other than static file serving to get bot attention.