Yes. And in retirement, I still code because I like the process of creating (hopefully cool) things. Even without remuneration. Ideally things that other people will use and benefit from in some way.
Cool site. I was curious and dropped your 100k list into a reverse DNS lookup site [1]. They may still have some of the records cached. I recognized quite a few of the scanner nodes and some other usual suspects.
Yeah, that’s pretty interesting! You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net and choosing ISP from the carousel. That’s ordered by bot transaction count rather than IP count though.
It never ceases to amaze me that these ISPs don’t bother to shut down the botnets. They could do so very easily. For example, they could identify the IP address of every bot that hit this honeypot with their ASN with one API call: https://api.knock-knock.net/check-asn?asn=<asn number>. (See https://knock-knock.net/api). They just don’t care!
The ISP's do not have a financial incentive to shut them down. To them that's a paying customer. The feds will go after the big botnets if they are touching financial networks or siphoning enough money from people because there is usually a few big bank accounts and virtual currency exchange accounts they can seize once big enough to look good in the media. That's why it's on us and a few big CDN's to block some of them.
Not the person you are asking but site operators can not tell intent. It could be something nasty on the network or a botter feigning ignorance.
I'd say its probably an acceptable casualty in the battleground that is the internet especially for little one-off sites hosting blogs, forums, chat servers, etc... For a bigger site I would expect that person may have to open a ticket with the platform such as Amazon accepting that some CDN's and firewalls may be harder to get the block removed. This is why we can't have nice things.
thats the hard part, right - my 76 year old dad is on his banking app while his samsung TV is allowing a bot to try and take over other accounts at the same bank on the same IP.
IP Blacklists, no matter how good can't stop this. You have to start using stats or deep-diving telemetry.
thats the hard part, right - my 76 year old dad is on his banking app while his samsung TV is allowing a bot to try and take over other accounts at the same bank on the same IP.
So appeal to emotion doesn't fly with me. If grandpa is 76 in the year of our lord 2026 that means he was 50 when the internet was getting popular and 59 when cell phones became very popular on the internet. He's not much older than I. He knows what's up.
God help the makers of that television if he finds out it has been spying on him and dorking around with his traffic. If they are lucky he will just take a baseball bat to it. If they are unlucky he will fly to their headquarters and end up on a viral bodycam video likely with a lot of supporters that will bail him out of jail.
IP Blacklists, no matter how good can't stop this. You have to start using stats or deep-diving telemetry.
I use a myriad of methods including IP blacklists. That's my choice and every site operators choice. I do not have to use deep-diving telemetry but you are free to do so.
Good question. You can certainly proxy SIP. But what’s notable here is that the traffic comes directly from organizations that should be secure: banks, infrastructure, governments. For a proxy to explain it, the proxy exit node would have to be running inside those institutions, on their networks. So from a security standpoint it doesn’t really matter whether a botnet is running inside the company or the company is being used as a proxy hop. Either way, a machine on their network has been compromised.
(And your P.S. is spot on. The attacker bears none of the cost; the clean IP reputation and the blame land on the compromised third party.)
I set up servers on the net that masquerade as a SIP relay by essentially supporting the protocol but with few authentication protections. Malware bots scan the IPv4 space looking for such machines that they can use as a relay. My honeypot is actually an extensible framework, and we also can mimic SSH, Telnet, HTTP, SMB, FTP, RDP, SMTP, MQTT, Node-Red, MODB, S7, and SNMP. Individual servers can easily be set up to scan any subset of those. Check out https://knock-knock.net to get a visual sense of what the honeypot is doing!
Yes - I would have expected better from these institutions as well, but there's always going to be someone who brings their rogue laptop onto the corporate net. The key is how fast the security catches it. They can use the api that I describe in the blog to check my honeypot for their IPs. Very simple to put into a daily or hourly script.
See the hidden world of bot attacks and scanner chatter. Listen to Internet Background Radiation on a virtual Geiger counter.
Here we are capturing Internet chatter across 8 protocols: (SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP), targeting 8 servers distributed throughout the world.
Check out the 3D spinning globe heatmap. Explore the most popular usernames and passwords across a variety of protocols. See the ISP Wall of Shame.
If the info is coming in too fast and furious, hit the pause button (or space bar if you have a keyboard).
We are using a framework for deploying and displaying honeypot activity: https://github.com/djkurlander/knock-knock. Honeypots transmit their data (in JSON format) to a monitor that stores the info in a SQL database and publishes the info to redis. The front end service (using uvicorn) gathers this info and serves it to browsers via web sockets.
The goal is to educate people (originally my kids) about one particular aspect of cybersecurity. I love it when people use the site for this purpose.
Yep, with ~80 knocks coming in per second and two 3D globe visualizations, it does make a lot of use of the browser. That said, it runs smoothly even on an iPhone browser. The server scales really well (longtime load average of 0.05 on a $6.75/year VPS :-).
OP here. Check out the new https://knock-knock.net. v1 got 40,000+ visits from HN alone, hoping you'll find v2 worth checking out too.
Watch bots trying to break into my honeypots, gain access to my files, place expensive VOIP calls, attack my HTTP server, and relay SPAM email. The new knock-knock.net shows you SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP attacks in real-time: where they are coming from (check out the spinning globe heat-map!), the most common usernames and passwords, info on why some of those usernames and passwords are being used, the worst offending IPs, and of course the ISP wall of shame. View the stats for the protocols together, or filter by protocol. All presented in what I hope is a very cool UI.
The new knock-knock.net aggregates attack info from multiple servers around the world and presents the info in one place, hence you'll see attacks come in at a furious pace, and may want to use the pause button (or space bar). Turning on audio (the speaker icon) lets you hear what some have called the "background radiation of the internet" on a virtual geiger counter. This is intended to be a fun, educational site, not a serious cybersecurity tool.
A few random, interesting things:
1) The locations of the bots doing the various protocol attacks differ pretty dramatically. For example, Romania, Poland, and the Netherlands are currently big for SSH bots, India leads for SMB, China is tops for RDP, and France for SIP, but the US is #1 overall.
2) SMTP attempts are usually sentry emails. SMTP bots first try to send an email to themselves so they can tell the server is a working relay. Notice that nearly all of the emails include my IP address in the subject or body (it appears here redacted as <target-ip>) so they can tell the relay is operative.
3) The Internet has been blocked for nearly all of the citizens of Iran since the January protests. However, I found it surprising that attacks still originate from servers there.
4) RDP and SIP bots will connect to a server and spam it practically non-stop. I had to set up an autoban for these protocols at 2,000 knocks - much lower than the 10,000 knock ban set for the other protocols.
5) As of this posting, we're still waiting for knocks from several African countries. They tend to have fewer internet servers than the rest of the world. However, we did get knocks from Jersey (the island, not the state or cow), Nauru (~10K people), and Monaco (~2 km^2). Surprising that we're still waiting for EU member Slovenia!
6) We've even seen knocks from space! Well from ISP SpaceX/Starlink anyway. You would think this would be expensive, but bots are often replicated on machines they infect, and they aren't paying the bills.
7) The worst offending ISP is ironically named "Unmanaged Ltd." Interestingly, it was previously DigitalOcean, but shortly after v1 was posted to HN and r/digital_ocean, and user comments skewered that ISP, their bot attacks dropped over 99%! Coincidence? Maybe. Maybe not.
Works great on desktop or mobile — try it out and let me know what you think. Happy to answer questions and take suggestions.
