Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.
replyI was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!
replyHumans never visit but I have some websites with ancient cms's. When I got bored playing with them I download the html, change the extensions to php and replace the site with a static copy. People then tirelessly try to hack it since they have laundry lists of known vulnerabilities. (Now that I think about it I regret not making the admin area public for added nostalgia.)
replyCould be because of number of pages you have. At work we have several million public content pages, so a few badly behaving bots can already do a lot of damage.
replyFor my personal website it’s 10x more bots but I barely notice because it’s a few pages.
Get a letsencrypt cert, I always get a massive wave of vulnerability probers after renewing.
reply[delayed]
replyI don't even have a domain name and I'm getting lots of hits.
replyI recently brought up a website on a never-before-seen .com domain. Within about 10 mins of bringing it up with a SSL certificate, Anthropic came knocking on the door requesting the front page. (Almost certainty due to them watching the Public Certificate Transparency logs)
replyOld and busted: serverless
replyNew hotness: DNS-less
imagine having a KPI tied to cash bonuses based on that...
replyI am always surprised that its considered legal.
IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...
replyThat sort of vulnerability scanning is at best legally dubious, and almost certainly illegal under CFAA and similar state statues when there's clear criminal intent. That's why the 2022 DOJ guidance regarding non-prosecution good faith security research was such a big deal at the time.
reply> IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...
From experience: this does happen regularly in some neighborhoods of some cities in the US, and even that isn't always an enforcement priority. So lack of enforcement on the internet, where most the perpetrators probably aren't even in a jurisdiction with an extradition treaty, isn't exactly surprising.
Unauthorized access is not legal, it's just not enforced in the slightest.
replyIllegal and actively enforced are different things. Report it to the hosting company originating the abuse and they usually don't care.
replyOpening port 80 and realizing the world is an anarchic warzone is a canonic rite of initiation for otherwise innocent backend devs and sysadmins.
replyThis is so true. Every junior sysadmin I have trained over the years (including myself) has had a “are we being attacked?!” moment when tasked with WAF report analysis, monitoring fail2ban logs, etc.
replyMonitoring WAN traffic really gets the paranoia juices flowing.
[dead]
replyMost servers with port 25565 open get hits from either Minecraft griefer bots, or from a bot that looks for that port and warns anyone on that server about the risks of leaving that port open. It doesn't take a huge scale operation to spam every IPv4 address in the world, there are only 2^32 of them, and even then many of those addresses are reserved.
replyAnother interesting thing here is the paths they're targeting, many are for newish AI coding tools
replyPeople or their agents must be accidentally committing or publishing their repository level secrets and configs with enough regularity that it’s worth scanning.
replyTotally. I'm sure this campaign was inspired by sloppy vibe coding
reply[flagged]
replyThere are a few novel ones but I’ve been seeing most of them in my logs for longer than generative AI has existed. This isn’t remotely new, the vector is just getting bigger.
reply