6 ms·

I would assume the fastest way to actually make this stop would be to setup a bunch of honeypot exploits, trigger their detection and someone will figure out wh

I would assume the fastest way to actually make this stop would be to setup a bunch of honeypot exploits, trigger their detection and someone will figure out what they did wrong. Other than not, with these huge companies you have 0 recourse.

robinpie 4d ago
(OOP here). I wonder if switching my replies from 299 to 200 OK would be enough for some of them.
- adzm 4d ago
  I came here to suggest the same thing. It should light up on the dashboards iirc.
- Joel_Mckay 4d ago
  Unlikely, but the lazy wonks could enable stratum 1 time services with the cars GPS/cellular receiver and RTC. Having done that for equipment in the past, we all know it is literary only $8.43/unit in parts. Also, setting ntp time as the tertiary fall back has been around for over a decade. =3
slau 4d ago
I actually think this is brilliant. Let the scanner IP get access to the most unpatched Wordpress, maybe even generate some garbage ERP numbers. Once the asset scanner detects the vulns, everyone will kick into high gear to patch this.
robotmay 4d ago
I did something like this a few weeks ago on my photography site: https://robertmay.photography/journal/meta-has-tried-to-scrape-this-site-1-million-times-in-2-weeks-ive-given-them-toasters-instead https://robertmay.photography/journal/meta-has-tried-to-scra... Meta not only hasn't noticed, but is currently sending about 11 requests per second to my site. I've also seemingly trapped one of those TV proxy scraper nets as I'm getting absolutely hammered by requests from all over the place now. I get maybe 10 legit visitors per day, and I'm currently blocking 406,787 IPs from things that have fallen into my honeypot. I've tweaked my site to return empty status responses a configurable amount of time but the traffic has been so intense that Traefik is now struggling, so I'm going to have to figure out something else. I was returning over-capacity errors and I think that was a mistake, I've swapped to 400 range status codes now. I don't want to use Cloudflare so I'm not sure what to do after this. The people at these companies are either incompetent or malicious.
- reaperducer 4d ago
  Since it's a photography site, route 'em over to goatse. That might get someone's attention.
  - robotmay 4d ago
    Haha I did debate going much worse with the junk images but wanted to err on the side of caution in case I subject possible clients to something like goatse.
- FabCH 3d ago
  Return a HTTP 301 pointing to https://facebook.com https://facebook.com? Might make them scan themselves instead.
Joel_Mckay 4d ago
Often, the folks you want to ban are not the hosts running the scans. One's best bet is to play possum, and use your clients last login IPs falling in your service area geo-IP ranges for a firewall white-list. Then redirect the other traffic for a black hole route. If the nuisance hosts assume they have driven the host offline, they will eventually give up and move on. =3

robinpie 4d ago

(OOP here). I wonder if switching my replies from 299 to 200 OK would be enough for some of them.

adzm 4d ago
I came here to suggest the same thing. It should light up on the dashboards iirc.
Joel_Mckay 4d ago
Unlikely, but the lazy wonks could enable stratum 1 time services with the cars GPS/cellular receiver and RTC. Having done that for equipment in the past, we all know it is literary only $8.43/unit in parts. Also, setting ntp time as the tertiary fall back has been around for over a decade. =3

slau 4d ago

I actually think this is brilliant. Let the scanner IP get access to the most unpatched Wordpress, maybe even generate some garbage ERP numbers. Once the asset scanner detects the vulns, everyone will kick into high gear to patch this.

robotmay 4d ago

I did something like this a few weeks ago on my photography site: https://robertmay.photography/journal/meta-has-tried-to-scrape-this-site-1-million-times-in-2-weeks-ive-given-them-toasters-instead https://robertmay.photography/journal/meta-has-tried-to-scra... Meta not only hasn't noticed, but is currently sending about 11 requests per second to my site. I've also seemingly trapped one of those TV proxy scraper nets as I'm getting absolutely hammered by requests from all over the place now. I get maybe 10 legit visitors per day, and I'm currently blocking 406,787 IPs from things that have fallen into my honeypot. I've tweaked my site to return empty status responses a configurable amount of time but the traffic has been so intense that Traefik is now struggling, so I'm going to have to figure out something else. I was returning over-capacity errors and I think that was a mistake, I've swapped to 400 range status codes now. I don't want to use Cloudflare so I'm not sure what to do after this. The people at these companies are either incompetent or malicious.

reaperducer 4d ago
Since it's a photography site, route 'em over to goatse. That might get someone's attention.
- robotmay 4d ago
  Haha I did debate going much worse with the junk images but wanted to err on the side of caution in case I subject possible clients to something like goatse.
FabCH 3d ago
Return a HTTP 301 pointing to https://facebook.com https://facebook.com? Might make them scan themselves instead.

Joel_Mckay 4d ago

Often, the folks you want to ban are not the hosts running the scans. One's best bet is to play possum, and use your clients last login IPs falling in your service area geo-IP ranges for a firewall white-list. Then redirect the other traffic for a black hole route. If the nuisance hosts assume they have driven the host offline, they will eventually give up and move on. =3