Hacker News Reader

Comment by amony | Hacker News Reader

Here are some examples. They are probing the website for vulnerabilities in web frameworks that I am not using. The probes are generating a lot of logs, incorrect referrer stats, etc:

    1.2.3.4 - - [15/Oct/2022:08:36:42 +0000] "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" 404 370 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"

    2.3.4.5 - - [15/Oct/2022:13:03:22 +0000] "GET /admin/controller/extension/extension/ HTTP/1.1" 404 370 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"

    3.4.5.6 - - [15/Oct/2022:05:41:00 +0000] "GET /1index.php HTTP/1.1" 404 370 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"

View on HN

These aren't really actionable, it's part of the noise floor.

Scanners gonna scan, etc.

If you send an abuse report for these and it's processed, the user is going to tell the ISP, yeah, I'm running a vulnerability scan as a public service, and the scans are going to continue.

You can put rules like someone said or you can ignore it.

While some scans might come from that actual host owners, the vast majority are coming from compromised systems. If the ISP is responsible and investigates they will be shut off.

Most types of scanning also violate the terms of service for almost all ISPs so even if the owner does claim it's a public service there's a decent chance they'll be shut off. If the scanner is brute-forcing or trying to exploit known vulnerabilities, for example.

I know a lot of people will find this to be wishful thinking. I've run security for some fairly large businesses and reported more than my share of compromised hosts. Obviously we don't report every scanner because it's time consuming and the cost/benefit isn't there, but the percentage of companies that respond is far more than zero.

I would say though, that you're less likely to get a response from a Whois contact for the IP than from a domain contact or a contact listed on the primary website of the domain owner. Whois contacts get so much spam they often go un-monitored.

The kind of scanning visible in those logs has already been reported by a ton of automatic reporters.

I run a publicly accessible web service, and get this stuff all the time.

My service happens to be fronted by nginx, so over time I accumulate config to match these and drop connections and drop from the logs entirely:

  location /wp-admin {
    access_log off;
    log_not_found off;
    return 444;
  }

(444 is a nonstandard error code that tells nginx to just close the connection, don't respond at all; if you want to be more mischievous you could return 301 "https://nsa.gov")

Yeah maybe spamming the NSA with a bunch of random bots whose only common attribute is your domain in the referrer tag is a bad idea.

I don’t think it’s illegal to redirect anyone anywhere. Either way, 301s don’t modify the referrer so they wouldn’t be able to tell.

I'm thinking that legal/illegal might not matter so much if you happen to annoy somebody at the NSA. And betting that they wouldn't be able to tell might prove regrettably over-optimistic.

This type of traffic is very common. We see thousands of these every day. A quick and easy solution to this would be to use Cloudflare's WAF. Would block most of this traffic before it reaches you.

Thank you. I would prefer to maintain full control of access to the site and not trust a large vendor such as CF. I know they have mechanisms that would stop this, but they may also impact normal users in a negative way.

if you want to remain in control, then do fire off abuse reports and consider firewalling off those IPs.

Could you elaborate on how they would impact normal users in a negative way? We rely heavily on CF so would be good to be knowledgeable about such things.

Just ignore them.

Log analyser tools will exclude them from reports.

It's only worth reporting abuse if there's something the ISP might do about it. Report a hacked server hosting malware etc. Don't bother for this.

Reply on news.ycombinator.com