Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

122

ggavinhking about 4 hours ago 71 commentsRead Article on knownagents.com

⚡ Community Insights

Discussion Sentiment

52% Positive

Analyzed from 1745 words in the discussion.

Discussion (71 Comments)Read Original on HackerNews

yabones•about 3 hours ago

Every server with port 80/443 open has thousands of hits a day from random boxes looking for wordpress login pages. The only new thing is that they're pretending to be a different type of annoying bot. There's a new layer of sophistication and subterfuge, but it's the same junk traffic we've always dealt with.

drewnick•about 2 hours ago

Think about how many webmaster and business owners' egos are stroked by all the traffic they are getting, when in actuality they are often just serving thousands of bots.

andai•about 1 hour ago

I was insulted recently reading about the apparently thousands of hits per second the rest of you guys are getting. Even the bots are shunning me!

whstl•36 minutes ago

Could be because of number of pages you have. At work we have several million public content pages, so a few badly behaving bots can already do a lot of damage.

For my personal website it’s 10x more bots but I barely notice because it’s a few pages.

hamdingers•about 1 hour ago

Get a letsencrypt cert, I always get a massive wave of vulnerability probers after renewing.

0xdeadbeefbabe•about 1 hour ago

I don't even have a domain name and I'm getting lots of hits.

Colegno•about 1 hour ago

I am always surprised that its considered legal. IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...

fultonn•32 minutes ago

That sort of vulnerability scanning is at best legally dubious, and almost certainly illegal under CFAA and similar state statues when there's clear criminal intent. That's why the 2022 DOJ guidance regarding non-prosecution good faith security research was such a big deal at the time.

> IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...

From experience: this does happen regularly in some neighborhoods of some cities in the US, and even that isn't always an enforcement priority. So lack of enforcement on the internet, where most the perpetrators probably aren't even in a jurisdiction with an extradition treaty, isn't exactly surprising.

sethops1•44 minutes ago

Unauthorized access is not legal, it's just not enforced in the slightest.

xena•34 minutes ago

Illegal and actively enforced are different things. Report it to the hosting company originating the abuse and they usually don't care.

TZubiri•about 2 hours ago

Opening port 80 and realizing the world is an anarchic warzone is a canonic rite of initiation for otherwise innocent backend devs and sysadmins.

manapause•39 minutes ago

This is so true. Every junior sysadmin I have trained over the years (including myself) has had a “are we being attacked?!” moment when tasked with WAF report analysis, monitoring fail2ban logs, etc.

Monitoring WAN traffic really gets the paranoia juices flowing.

gavinhking•about 3 hours ago

Another interesting thing here is the paths they're targeting, many are for newish AI coding tools

thedougd•about 2 hours ago

People or their agents must be accidentally committing or publishing their repository level secrets and configs with enough regularity that it’s worth scanning.

gavinhking•about 2 hours ago

Totally. I'm sure this campaign was inspired by sloppy vibe coding

hluska•about 2 hours ago

There are a few novel ones but I’ve been seeing most of them in my logs for longer than generative AI has existed. This isn’t remotely new, the vector is just getting bigger.

kevin_nisbet•7 minutes ago

Just in case any of the authors read HN, I'm getting a pretty crazy rendering bug on this page, where a bunch of the contents are redrawing up and down by a few pixels. It seemed to go away with resizing the width a few times, but I didn't look into it too hard. My page width was probably small on first draw. Incredibly distracting though and hard to read with the text moving. Using latest chrome, and it occurred on more than one page refresh. I didn't dig in beyond that though.

saghm•4 minutes ago

I'm seeing the same thing on Firefox on Linux. It almost looks like the page scroll is jiggling up and down a tiny amount constantly when it's supposed to be stationary.

binaryturtle•about 3 hours ago

On average about 100 (TCP) requests hit my home router per minute doing various probing and scanning. Lots of checking for the telnet port obviously. Sometimes you can see a swarm of entirely different IPs scanning the full port range (probing the ports one-by-one).

You'll see a lot of deepfield, censys-scanner, visionheight.com, shadowserver.io, etc., but also the usual suspects of Chinese or Russian IPs.

With OpenWRT I use something like this: `tcpdump -i pppoe-wan 'inbound and tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'`, or alternatively `tcpdump -i pppoe-wan 'inbound and tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn and not port 44000'`, if we have some torrent client running (e.g. here at port 44000) which would mess up the result. I'm not sure it's the best way to handle this, but it's definitely enlightening what bounces off on the router.

miah_•about 2 hours ago

The easiest way to deal with the usual suspects is to just block the entire countries network range(s). There really is no reason they should be connecting to your home router anyway, and you lose nothing from blocking them.

Sure their packets will still hit your router, but if they are dropped immediately at least you're not wasting a syn-ack on them.

tommyage•about 1 hour ago

I, temporarly, banned some ip range. I didn't find a source for pinpointing countries; though I am interested. Could you point me to some sources which, deterministically, resolve to some countries? To my knowledge you can not reliably identify countries by ip since this would be dependent on DNS servers. Though I am just a application programmer!

Thanks in advance.

thesuitonym•about 1 hour ago

Your router doesn't care about their DNS settings. IP addresses are very easy to tie back to countries. The reason they say it's not reliable is because it's trivial to spoof the country, but even so, a lot of attackers don't even bother. It's sort of like the Nigerian prince scam calls: if you're wise enough to block Russia, you're not worth their time.

Your firewall vendor should supply you with country lists, just select the known bad ones and drop their traffic. If you have a consumer grade router, you will probably have to configure the blocklists manually.

Asmod4n•about 1 hour ago

Routers got such a thing build in nowadays, just gotta enable it (not the ones from your ISP of course)

sroussey•about 1 hour ago

I have ubiquity UniFi for this reason (amongst others). OpenWRT is a good choice as well. Most home router software is such junk, might as well leave the door open..

heywire•about 1 hour ago

This is one reason I don’t mind that I’m behind CGNAT.

impish9208•about 2 hours ago

I can corroborate visionheight and shadowserver from my firewall logs.

Bender•about 3 hours ago

Many of those user-agents listed are often faked. Look up which ASN owns their IP. If I block most VPS providers most of the faked bots vanish. There are still some running from residential and phones using hijacked code (readers that are not really just readers but really multipurpose proxies). On that note, do not trust the linked source code but rather decompile the live code your phone is running and have AI analyze it.

codegeek•about 3 hours ago

Is there an easy way to block any requests originating from VPS etc instead of residential/commercial IP from legitimate users ? I know cloudflare does a few things but I really want to figure out a way to block any request say at nginx or caddy (reverse proxy) from reaching origin servers if they are not from an IP that is not a VPS etc.

djkurlander•about 2 hours ago

I run an open source honeypot that collects these botnet scans and produces blocklists.

Blocklist download and configuration: https://knock-knock.net/blocklist

Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net

API: http://knock-knock.net/api

Bender•18 minutes ago

There are several methods. [1] The most aggressive method-02 and method-03 on my document will block VPS and some data-centers but that also means it will block some legit users that are on a VPN. Most VPNs transit a data-center. If experimenting with these methods use a test server that you do not care about and set up a dummy site and ask people in your circle of friends to test it. I have to step away for a bit but if you have questions I will try to answer.

[1] - https://nochan.net/b/Internet-Crap/20260606-How-To-Block-Som...

basilikum•about 2 hours ago

> /commercial IP from legitimate users

No, because legitimate users do not just use residential and "commercial" IPs. Like me, right now

VladVladikoff•about 2 hours ago

You are the 0.001%

VladVladikoff•about 2 hours ago

Yes but it’s not cheap. Maxmind and ipinfo etc sell a tier that tells you this information, then you can 403 based on it. But the price is nuts like $40,000 a year.

yardstick•10 minutes ago

Open source works just fine for this - take a look at geoacumen-country

https://github.com/geoacumen/geoacumen-country

reincoder•44 minutes ago

I work for IPinfo. We offer IPinfo Lite for free. With a little bit of time in identifying the ASNs, you can implement a decent way to block a good number of bots fairly easily using the free data alone.

KomoD•about 2 hours ago

You don't need to spend anywhere near $40k a year to get that info... You don't even need to spend $1

sparkling•about 1 hour ago

Focsec.com IP database for offline use (datacenters, VPNs, proxies, bots) runs around $1k/month for internal-only use.

gavinhking•about 3 hours ago

Yeah, that's exactly what these visits are: faked user agents that fail IP verification or Web Bot Auth. What's interesting is the surge across so many websites in the last week.

Bender•about 3 hours ago

There are many possibilities but one of them could be some new vuln was released and they are looking for it. That would require looking at the URL's they are requesting. Botters run their own purpose built campaigns. Do you also have a summary of URL's requested by unique counts?

gavinhking•about 3 hours ago

Looks like many of the paths relate to AI coding tools. There are some examples below the chart

bflesch•about 3 hours ago

Same for the origin IP address. The fiber leaving your country is tapped, and those people can inject packets with any origin IP that they want. Your ISP has no way to check if their peer actually received a certain packet from a certain country or not.

From a technical perspective, all this "china/russia" attribution is built on a quite shaky foundation. As a sysadmin you'd never know if it would be the British crown attacking your European company instead.

Not minimizing nation state cyber crime here, but the packet goes through many hands with different incentives.

pixl97•about 2 hours ago

Problem here is there are not single fibers attaching (most) countries, but a bunch of them. If you control both the ingress and egress for some particular users it's possible, but if you don't then your probing packing may end up back in China with a lot of evidence of backscatter.

bflesch•about 1 hour ago

I'd be surprised if there is a single route from EU to non-EU countries which does not pass through British control.

Tharre•about 1 hour ago

Why would you voluntarily pretend to be a AI bot, when those have already a much higher chance of being blocked? Seems holly unproductive.

Best hypothesis I can come up with is to somehow make the AI companies look bad, but they seem to be doing an excellent job at that themselves already by scraping everyone hundreds of times per hour over and over.

esskay•16 minutes ago

Because businesses dont want them blocked, that would be a very stupid thing for most of them to do given its becoming a vital traffic source now that people are using chatbots instead of google.

xgulfie•31 minutes ago

Most websites don't have an incentive to block AI bots to their main sites. Think businesses, government and community websites, nonprofits, etc.

blobbers•41 minutes ago

Interesting thought: what if the idea of an open internet is over.

What if we're now moving into a world of strictly KYC. The same way "The Facebook" generated massive revenue by creating a KYC world.

nate-gehringer•about 1 hour ago

I recently blogged about some Cloudflare Workers I developed to combat this type of traffic: https://code.backwater.systems/blog/#2026-06-29T23:40:00.000...

sethops1•23 minutes ago

Using a normal page per blog entry would go a long way to making your site more indexable, readable, shareable and seo-able. (Good article btw).

andai•about 1 hour ago

Man, this "someone" guy sounds like a real jerk!

pjc50•about 3 hours ago

Someone is always running mass vulnerability scans. That's a "water is wet" state of the Internet.

gavinhking•about 3 hours ago

Definitely, the point here though is there is a stat sig surge in the chart in the last week, across thousands of websites. At least a surge in this particular spoofing pattern.

KomoD•about 2 hours ago

It's still not really anything special. Thousands isn't even large scale.

Any random bozo can trigger that.

gavinhking•about 2 hours ago

This is a random sample of completely unrelated websites, which indicates that the total scale is much larger. This is not saying that it is difficult to make thousands of requests.

pixl97•about 2 hours ago

I think this is more of a "if you left your AI tools exposed someone is looking for them" change. Hacking someone else's agents sounds like a great way to spend less on your own tokens.

Maxion•about 1 hour ago

Nah these are just the typical vuln scans that try all kinda basic shit, looking for anything commonly used AI tools included.

j45•about 1 hour ago

This kind of stuff is getting pretty wild, even for using something like Cloudflare it seems like a good idea to have another layer behind it that's non-cloudflare for when vulnerabilities are discovered.

thesuitonym•about 1 hour ago

What, like some kind of firewall?