djkurlander

6 ms·

31.
by djkurlander 8mo ago
Exactly right. I just didn’t want the bad actors to know my own IPv4 address so that they might try to cause havoc or treat my site differently.
32.
by djkurlander 8mo ago
If the bot sees no login / password sequence, there’s no way for it to brute force credentials. If the server only takes ssh keys, that will cause an immediate disconnect. Which is why this setting is best practice when setting up a se
33.
by djkurlander 8mo ago
Sadly? Intentionally! The IP is hiding behind Cloudflare mainly to make it much harder for the bots to figure it out. Blocking you from messing with the stats is just icing on the cake. :-)
34.
by djkurlander 8mo ago
I was aware of port knocking, but not the Mac malware scanner with the similar name. Good to know!
35.
by djkurlander 8mo ago
…but if it did accept a password it would be 12345.
36.
by djkurlander 8mo ago
Good observation. I am using a Cloudflare orange cloud proxy to hide the IP address. I’m also blocking direct access to my web server by IP addresses to make it that much more difficult to associate the IP address with my domain. Most peopl
37.
by djkurlander 8mo ago
!!! Good luck trying to log in via port 22. The real ssh port is located elsewhere and doesn't accept passwords. :-)
38.
by djkurlander 8mo ago
OK - thanks for the excellent suggestion. It's now implemented (just two SQL queries that will run as a cron job every night). You can grab the month and year offending ip blacklists this way. wget https://knock-knock.net&#x
39.
by djkurlander 8mo ago
Some of the passwords definitely come from leaks, but adding 123 or 2026! to the end of a frequent username is a surprisingly common pattern. Lots of suffix variants: 123!, 2025, 2025!, @2025, @123, etc. In fact, the Trivia pane of knock-kn
40.
by djkurlander 8mo ago
I'm reporting the bots that have visited to abuseipdb once per day, but yeah, there should be a free alternative. You aren’t the first person to have asked for this. It would be trivial to write out a file that people can grab for free
41.
by djkurlander 8mo ago
I know, at some level, it seems crazy that the bots are spending so much time on this. However, there are plenty of machines on the Internet, and presumably most of these bots' machines were captured using this same technique.
42.
by djkurlander 8mo ago
The attempts started almost immediately, but they certainly accelerated over the course of the first few days. Initially, I think it was less than 1 knock per minute, but now it’s over 8. As a comparison, I set up https://amsterd
43.
by djkurlander 8mo ago
Some things never change. One of my favorite visualizations for this is to switch to the globe view and choose the “HEAT” style for a 3D heatmap superimposed on the globe. Green means few hits, and red signifies lots of hits. The Netherlan
44.
by djkurlander 8mo ago
Yes, Microsoft shows up a lot. Some of these bots are running on Azure. My favorite ISP to spot occasionally is SpaceX / Starlink. That can’t be the most economical ISP for bot traffic, but machines can be infected, even on Starlink.
45.
by djkurlander 8mo ago
If you are on the desktop, you should be able to scroll sideways either by choosing a menu icon at the top, or by clicking on a panel (which will rotate the panels to the left). On the phone you can visit a panel by choosing the icon from
46.
by djkurlander 8mo ago
That’s a valid point. We can easily see where the attack is coming from but not who or which botnet. Some of these can be inferred by the pattern of usernames and passwords attempted, and the ISPs. Someone suggested that I collect the clien
47.
by djkurlander 8mo ago
My $6.75 per year vps was a Dedirock Black Friday sale that I found https://lowendtalk.com . https://cheapvpsbox.com/ reports several nice Los Angeles sales still going on from various providers. My London, Tokyo
48.
by djkurlander 8mo ago
My $6.75 per year VPS was a Black Friday sale from Dedirock on https://lowendtalk.com . Some of the Black Friday sales are still being honored. The site https://cheapvpsbox.com/ has a nice search engine for cheap
49.
by djkurlander 8mo ago
Many/most of these are servers that have been compromised. DigitalOcean is certainly one of the biggest ISPs/providers; however, I’m betting that if you looked at ratio of knocks per ASN IPs registered, DigitalOcean would still be
50.
by djkurlander 8mo ago
contrib directory added!
51.
by djkurlander 8mo ago
Nice idea. The original VPS is in Los Angeles, but I installed the app more recently on VPS's in London, Tokyo, and Amsterdam. I've been noticing some interesting regional differences, but it may just be smaller sample of knocks f
52.
by djkurlander 8mo ago
OP here. site: https://knock-knock.net Every server with port 22 open gets hammered by bots trying to brute-force SSH. I built a honeypot that accepts every connection, records the credentials they try, and displays it all on a
53.
Show HN: Knock-Knock.net – Visualizing the bots knocking on my server's door(knock-knock.net)
224 points by djkurlander 8mo ago|95 comments